SharePoint 2016 and 2019 just ran out of patches, and this time there's no extension you can pay for

On July 14, 2026, SharePoint Server 2016 and 2019 fell out of extended support. Nothing shut down, no intranet stopped loading, and that is exactly the trap: everything keeps working just like last week, except that now, when the next vulnerability shows up, there will be no patch. Not free, not paid. And we know how that ends, because exactly one year ago we watched it live: it was called ToolShell.

The date has passed and your intranet is still on

Since July 14, Microsoft no longer publishes security updates or provides technical support for SharePoint Server 2016 or 2019 (Project Server 2016 and 2019 got hit the same day). The servers keep booting, people keep uploading documents, and in most companies nobody has noticed a thing. That is the problem with end-of-support dates: they don't hurt the day they happen. They hurt the day someone publishes a critical CVE and you discover you're on the list of those who will never get the patch.

And there is a lot of on-prem SharePoint out there. Not on the corporate website's front page: in the HR intranet, in the engineering department's document manager, in that approval workflow somebody built in 2017 for which neither the consultant nor the documentation remains. It works, nobody touches it, and precisely because of that, nobody migrates it.

This time you can't pay for the extension

With Windows 10 or Windows Server, latecomers have an escape route — outrageously priced, but real: Extended Security Updates (ESU), paid patches for after end of support. For SharePoint Server 2016 and 2019, that program does not exist. There is no check to write: the only on-prem version still receiving patches is SharePoint Server Subscription Edition. Microsoft has left two roads open — its cloud or its subscription — and removed the third one, which was paying to stay put.

You can have opinions about the commercial play (we have ours: it's the same lever we already saw with virtualization licensing — pushing by price and by calendar toward wherever the vendor wants you to be). But the commercial debate doesn't change the technical fact: a collaboration server full of internal documents, exposed to half the world and with no future patches, is a decision someone at your company is making by omission with every passing week.

ToolShell was the dress rehearsal: over 400 organizations in four waves

If anyone doubts that on-prem SharePoint is an attractive target, no theorizing is needed: just look at July 2025. The vulnerability chain dubbed ToolShell (led by CVE-2025-53770, CVSS 9.8) allowed unauthenticated remote code execution on SharePoint Server. Between July 17 and 21, across four waves, over 400 organizations were compromised — including the US agency that manages the nuclear arsenal (NNSA). Microsoft attributed the exploitation to three Chinese actors — Linen Typhoon, Violet Typhoon and Storm-2603 — and the latter went on to deploy Warlock ransomware on compromised servers.

SharePoint Online was not affected by ToolShell. That asymmetry — the same product, attacked in its on-prem version and safe in the cloud because the provider patches at scale within hours — is the honest argument for migrating. Not "the cloud is the future": the cloud is, in this specific case, the one patching for you on a Sunday night while your team sleeps.

The three ways out (and when each one makes sense)

The fourth way out almost nobody offers you: switching it off

Before signing off on any migration, measure actual usage. In nearly every veteran SharePoint we've seen, a huge share of the content hasn't been opened in years: document versions from closed projects, sites for departments that no longer exist, libraries duplicated "just in case". Migrating that to the cloud is not digital transformation: it's paying premium storage for clutter, and dragging into the new tool the mess that made the old one fall into disuse. Sometimes the right answer for half a SharePoint is cheap read-only archiving and an orderly shutdown, with the real migration reserved for what's alive.

If you can't migrate today, at least do this

A serious migration takes months, and support has already ended. In the meantime, these steps reduce risk for real (don't let anyone sell them to you as the plan: this is the tourniquet, not the cure):

In short

SharePoint 2016 and 2019 won't warn you: they will keep working normally until the day they suddenly don't. There is no ESU, so the decision isn't whether to move the content, but where to and how much of it. Our short recipe: measure what's used, archive or switch off what's dead, take what's alive to Microsoft 365 unless regulation dictates otherwise, and for as long as the transition lasts, treat the old farm as what it has been since July 14: a system without a safety net. At everyWAN we've spent years walking companies through exactly that journey — from the server in the back room to the modern workplace — as part of our Modern Workplace service. If you have one of these SharePoints breathing in a corner and want a plan with dates instead of a scare with a date, let's talk.

Sources (verified): end of extended support for SharePoint Server 2016 and 2019 on Jul 14, 2026 — Microsoft Learn (2016) and Microsoft Learn (2019); no ESU program for SharePoint and migration paths — Channel Insider; upgrade to Subscription Edition via database attach, directly from 2016 or 2019 — Microsoft Learn (upgrade process); ToolShell / CVE-2025-53770, actors Linen Typhoon, Violet Typhoon and Storm-2603, machine key theft — Microsoft Security Blog; over 400 organizations compromised across four waves (Eye Security), NNSA among the victims — CyberScoop; Warlock ransomware deployed by Storm-2603 — The Record.