SharePoint Server 2016 and 2019 are already unsupported

Extended support for SharePoint Server 2016 and SharePoint Server 2019 ended on 14 July 2026 US Pacific time, which was 15 July in Australia. Project Server 2016 and 2019 ended the same day. There is no Extended Security Update program. The exits are SharePoint Server Subscription Edition or SharePoint Online, and planning should start now.

Neither date arrived quietly. SharePoint Server 2016 left mainstream support on 13 July 2021, and SharePoint Server 2019 followed on 9 January 2024; both then ran on security fixes only until the shared extended end date. Nothing visibly changed on the day. Sites load, documents open, search returns results. What changed is that Microsoft has stopped fixing whatever attackers find from here on.

What actually ended on 15 July 2026?

SharePoint Server 2016 and 2019 both follow Microsoft's Fixed Lifecycle Policy, and both reached the end of the road on the same day. As of that date:

• No further security updates are released for SharePoint Server 2016 or 2019, at any severity rating.
• No further non-security fixes or updates are released for either product.
• Microsoft no longer provides technical support for either product.
• Project Server 2016 and Project Server 2019, which run on the same farms, reached their extended support end on the same day, per their own lifecycle pages.

The farm itself does not stop. That is the trap. An unsupported SharePoint server looks completely healthy right up until someone else finds the next vulnerability, and from now on nobody is coming to fix it.

Why do attackers care that SharePoint is unsupported?

Because July 2025 was the rehearsal. That month, an exploit chain publicly reported as ToolShell was used in a broad wave of attacks against internet-facing on-premises SharePoint servers. The chain combined a spoofing flaw, CVE-2025-49706, with a remote code execution flaw, CVE-2025-49704. Microsoft patched both in its July 2025 security update; within days attackers were exploiting two closely related bypasses, CVE-2025-53770 and CVE-2025-53771, and Microsoft had to ship emergency fixes for every supported version.

Microsoft attributed the exploitation to three actors: Linen Typhoon and Violet Typhoon, two Chinese state-affiliated espionage groups, and Storm-2603, a China-based actor that went further than data theft.

The ransomware deployed was Warlock, and the ingress point was the SharePoint server itself. Part of the clean-up guidance was to rotate ASP.NET machine keys after patching, because the attackers had stolen cryptographic material that could let them back in after the fix was applied. Compromise of a SharePoint farm is rarely contained to SharePoint: the farm holds contracts, personal information and payroll documents, it is joined to Active Directory, and in many businesses it is published to the internet for remote access.

Two facts from that wave matter for this deadline. First, the affected products were exactly the on-premises versions: SharePoint Server 2016, 2019 and Subscription Edition. Microsoft was explicit that SharePoint Online in Microsoft 365 was not affected. Second, in July 2025 all three server versions were still in support, so 2016 and 2019 received the emergency patches. The next ToolShell-class flaw will be patched for Subscription Edition only. Attackers routinely compare a vendor's fix against the previous build to locate the hole, so every SharePoint security update from now on doubles as a signpost to a permanent, unpatchable vulnerability in 2019 and 2016.

Is there an Extended Security Update program for SharePoint?

No. This catches people out because the answer is different for other Microsoft products. Windows 10, Windows Server and SQL Server all have documented, priced ESU programs that buy time after end of support. SharePoint Server 2016 and 2019 have nothing of the kind: the lifecycle pages list a hard end date and a link to migration guidance, and that is all.

What are the ways out?

SharePoint Server Subscription Edition, for workloads that must stay on-premises

Subscription Edition is the only on-premises destination. It follows the Modern Lifecycle Policy, so there is no fixed end-of-support date to hit next; instead it receives feature updates on a rolling basis, and Microsoft's servicing policy supports each build for one year after release. Staying current becomes routine patching rather than a migration project every few years.

The documented upgrade method is database attach, and it works directly from both 2019 and 2016. Microsoft's upgrade documentation confirms Subscription Edition supports both N-1 and N-2 upgrades: content and service application databases from SharePoint Server 2019 or SharePoint Server 2016, including Project Server 2019 and 2016, attach and upgrade directly. A 2016 farm does not need to pass through 2019 first. Practical points worth knowing before scoping:

• This is a new-farm migration, not an in-place upgrade of the existing servers. You build a Subscription Edition farm, copy the databases across, attach and upgrade them, then cut over. Plan a change window and a rollback.
• Databases must be at version 16.0.4351.1000 or higher or the upgrade is blocked, so the old farm needs to be brought fully up to date first. That work also closes ToolShell if the July 2025 updates were never installed.
• Only 2016 and 2019 upgrade directly. SharePoint 2013 and earlier must first be upgraded to 2016 or 2019 by database attach before moving to Subscription Edition.
• Server-side customisations have to be reinstalled on the new farm, which makes the customisation audit part of the critical path rather than an afterthought.

SharePoint Online, for everything that can leave the server room

Migrating to SharePoint Online in Microsoft 365 ends the patching treadmill permanently: there is no farm to patch, no lifecycle date to track, and the ToolShell wave demonstrated the practical difference, since the online service was not affected while on-premises servers were being ransomed. Document libraries, team sites and intranet content generally map cleanly. The honest caveat is that classic workflows, InfoPath forms and full-trust custom code do not migrate as-is; they need to be rebuilt on Power Automate, Power Apps or modern SharePoint patterns, and that rework belongs in the plan and the budget from day one.

Choosing between them

A workable rule of thumb: farms that are mostly document libraries and team sites belong in SharePoint Online; farms wrapped around custom code, specific data-residency commitments or tightly coupled line-of-business integrations may justify Subscription Edition, at least as a first hop. Plenty of Australian businesses land on a split: the bulk of content to SharePoint Online, and one small, well-patched Subscription Edition farm for the workload that genuinely cannot move yet.

What should happen this week?

1. 1List every SharePoint and Project Server farm and its exact version and build, from the Servers in Farm page in Central Administration. Include the farm nobody admits to owning.
2. 2Establish which farms are reachable from the internet, whether published through a reverse proxy, exposed for remote access or linked from an extranet. The ToolShell wave travelled through internet-facing servers, so unsupported internet-facing farms go to the top of the list, and external publishing deserves a review while the exit is planned.
3. 3Confirm the July 2025 security updates were actually installed and the ASP.NET machine keys were rotated afterwards. A farm that missed either step may already be carrying a visitor, and that changes the project from migration to incident response.
4. 4Bring every farm up to its final updates regardless of the exit chosen, since the Subscription Edition upgrade is blocked below database version 16.0.4351.1000.
5. 5Audit customisations: workflows, InfoPath forms, farm solutions and third-party add-ins determine which exit each workload can realistically take.
6. 6Pick the exit per workload, cost it, and put dates against it.

The deadline has already passed, so the useful measure now is not the date but the gap: every month an internet-reachable, unsupported SharePoint server stays up, the odds shift further towards the attacker. Frontrow's advice is to treat the farm as exposed from 15 July 2026 onwards and sequence the work accordingly, starting with whatever the internet can see.