Microsoft has delayed a major update for Exchange Server Subscription Edition, and the company says AI-powered bug-finding work helped create the extra delay. Exchange SE CU1 still has no release date, even though Microsoft says the update is coming.
Microsoft published an explanation on 17 Aug 2026, describing the work still underway before CU1 can ship. The Exchange team is handling reported issues, checking whether they represent real security problems, reproducing them, creating fixes, testing those fixes for regressions and other issues, then releasing updates each month.
Why Exchange SE CU1 keeps moving
Microsoft is using a variety of AI tools to help find vulnerabilities in its products. That work has produced more issues for the Exchange team to review and address, adding pressure to an update that must include a large set of changes.
The scale of Microsoft’s security work helps explain the workload. Microsoft’s Patch Tuesday release contained 421 bugs, while last month’s Patch Tuesday included 622 CVEs. Those figures do not provide a release date for CU1, but they show why the company’s security pipeline remains active while the Exchange update is being prepared.
Microsoft has chosen to put security above all else, and that decision has contributed to the delay. The company does not want to release CU1, then replace it with another update containing new security fixes soon afterward. That approach would create double the update work for organization administrators.
What CU1 must contain
Exchange SE is the subscription version of Microsoft’s email server. A Cumulative Update, or CU, is a new version of the package that includes recent bug fixes along with other changes, such as new features or the removal of deprecated code.
CU1 must include everything released since RTM, or Release to Manufacturing. That makes the timing important: Microsoft needs to gather the required changes into one update while also making sure the package reaches a stable point before release.
Microsoft said, “We are regularly rolling our monthly security payload into our internal CU1 build and plan to release Exchange SE CU1 as soon as we get a reasonable stable point and have a month without pressing security payload.”
That plan links the release to two conditions. The internal build must reach a reasonable stable point, and Microsoft wants a month without a pressing security payload that would force another immediate update.
No date yet, but Microsoft says CU1 is still coming
Microsoft has not provided a specific release date for Exchange SE CU1. The company says it is working through the issues instead of publishing an update that might need a replacement soon after launch.
For organization administrators, the delay means waiting for an all-inclusive package rather than planning around a confirmed delivery date. Microsoft’s position is that one stable CU1 is preferable to releasing one update and then asking administrators to handle another with new security changes.
The company ended its explanation with a direct message: “In short: Exchange SE CU1 is coming; we do not have a date to give you. But we did not forget about it.”
That leaves the status clear, even if the schedule is not. Exchange SE CU1 remains in development, Microsoft continues to add monthly security work to its internal build, and the release will happen once the company reaches the stability point it wants without another pressing security payload.
Based on
