Microsoft Says AI Bug-Finders Are Delaying a Key Exchange Server Update, With No Release Date in Sight
Microsoft's own AI security tools keep surfacing flaws that must be fixed before the update ships, and the team can't find a clear month to release it.
Key points
- Microsoft has delayed Exchange Server SE Cumulative Update 1 (CU1), a major bundled software update, with no firm release date as of June 2026.
- AI-powered tools scanning Microsoft's own software for security flaws are producing a steady stream of issues that must be fixed before CU1 ships.
- Microsoft originally promised CU1 by mid-2026, revised that to "second half of 2026", and has now stopped giving any date.
- Shipping CU1 alongside a separate security patch in the same month would double the update work for IT administrators who manage corporate email servers.
Microsoft's corporate email server software, Exchange Server SE (SE stands for Subscription Edition, meaning companies pay a recurring fee rather than buying it outright), is missing an update promised months ago. A Cumulative Update, or CU, bundles every recent bug fix plus new features into one installable release. Microsoft publishes these once or twice a year, and many system administrators prefer waiting for a CU over applying individual patches one by one.
The problem, as The Register AI first reported, is that this CU keeps slipping.
What is actually holding the update up?
AI tools built to find security flaws are finding them faster than the team can clear the queue. Microsoft has been deploying artificial intelligence tools across its engineering teams to scan its own products for vulnerabilities, weaknesses in software that attackers could exploit. Those tools are working. They're also generating a constant backlog of issues that must be verified, reproduced, fixed and tested before anything ships.
The Exchange team posted an explanation on its official blog under the blunt title "Where is Exchange SE CU1 anyway?" The post says the team is "working through reported issues" and rolls new security fixes into its internal CU1 build every month. It plans to ship CU1 only when it finds "a month without pressing security payload", one where no urgent security patch needs to go out at the same time.
The concern is practical. Two major releases in one month would force administrators to install both quickly. The team describes that as "double the update work" and warns that testing two large releases in parallel would be "very challenging."
Why does the security backlog keep growing?
Microsoft adopted a formal "security above all else" policy after suspected Chinese state hackers exploited Exchange flaws to breach email accounts at US government agencies. That incident drew sharp criticism from Washington and put Exchange under intense scrutiny. As we reported on 31 July, Microsoft's Project Perception automates vulnerability detection and patching across its products, and the Exchange team is now working through what that pipeline surfaces.
The blog post is candid about the planning gap: nobody appears to have modelled what a steady flood of AI-generated bug reports would do to a release schedule. Our 11 August story on AI finding a Zoom flaw in a single day that once took nation-states months showed the same dynamic from the outside; here it's hitting Microsoft's own team from within.
| Target | Status |
|---|---|
| End of H1 2026 (original) | Missed |
| Second half of 2026 (revised) | No date given |
| Current commitment | "CU1 is coming" |
What does this mean for IT teams?
Administrators running Exchange SE should keep applying monthly security patches as they arrive. Those patches are still shipping on schedule. CU1 will deliver everything in one bundle eventually, but Microsoft won't say when. The message from Redmond is simply: "We did not forget about it."
Organisations that chose Exchange SE partly for its subscription-based update promise may want to factor this delay into planning for the rest of the year. A subscription that doesn't deliver its updates on time is a harder sell, and Microsoft hasn't explained how it'll prevent the same bottleneck with CU2.
Common questions
Is Exchange email itself broken or at risk right now?
No. Microsoft continues to ship monthly security fixes for Exchange SE. The delay affects only CU1, not the ongoing patches.
Do ordinary email users need to do anything?
No action is needed from end users. This affects server administrators, not the people who send and receive email. Your IT team handles it.
Will AI tools keep causing delays like this in future updates?
Microsoft hasn't said. The team is adapting its release process as it learns how many issues AI scanning can surface, but it's offered no timeline or policy change to prevent the same situation from recurring.
