Microsoft can't say when its next Exchange update ships, blames AI bug backlog

Microsoft has missed its own deadline for Exchange Server Subscription Edition Cumulative Update 1, and now says it can't give a new one. The update was first promised for the first half of 2026, then pushed to the second half. Microsoft's Exchange team says the holdup is a backlog of AI-flagged vulnerabilities that still need human validation before anything ships.

In a public statement, the team said it's "working through reported issues, which includes validation that they are real security issues, reproducing, fixing, testing for regressions and issues after fixes are deployed." Its closing line offered no comfort to admins waiting on the release: "Exchange SE CU1 is coming; we do not have a date to give you."

The bottleneck isn't finding bugs, it's confirming which ones are real. AI-powered vulnerability scanners are increasingly good at flagging candidate issues at a volume that outpaces the reproduce-fix-regression-test cycle a team can actually run, especially for software with Exchange's blast radius. That's a different failure mode than the usual "AI wrote buggy code" story: here, AI tooling is finding more legitimate problems than the humans downstream can triage.

Exchange's caution has a specific history behind it. Past vulnerabilities in the product were exploited by suspected Chinese state-linked attackers, which is why Microsoft says it now prioritizes security validation over shipping on schedule, even when that means an indefinite delay with no committed date.

For teams evaluating AI code-review or vulnerability-scanning tools, it's a useful data point: the tooling can outrun your team's ability to act on what it finds, and a bigger bug queue isn't automatically a win if nothing gets fixed faster as a result.