Several Microsoft products lost their security updates on 13 October 2026. The next big one, Windows Server 2016, follows on 12 January 2027, and that is ten weeks away.
On 13 October 2026, Microsoft's monthly security release doubled as a finish line. Office 2021 retired, the final paid year of updates for Windows Server 2012 R2 ran out, and businesses paying for extended Windows 10 updates reached the end of their first year.
Nothing stopped working that morning. That is exactly the problem. Unsupported software keeps running, quietly, while every new security flaw found in it stays open for good.
The dates that matter
If any of these are still running in your office or server room, they need a plan.
| Product | What changed | The fix |
|---|---|---|
| Windows Server 2016 | Security updates end 12 January 2027 | Upgrade or rebuild on a supported server, or buy paid extended updates as a stop-gap |
| Office 2021 and Office LTSC 2021 | No security updates since 13 October 2026 | Microsoft 365 Apps |
| Windows Server 2012 and 2012 R2 | Final year of paid updates ended 13 October 2026 | Rebuild the workload on a supported server |
| Windows 10 Pro (business ESU) | Year 1 ended 13 October 2026; Year 2 costs double | Windows 11, or replace the PC |
| Windows 11 Home and Pro, version 24H2 | End of servicing 13 October 2026 | Update to version 25H2 |
Home users have a little more room: Microsoft extended its free consumer Windows 10 update programme to October 2027. That extension does not cover business licences.
Why "it still works" is not good enough
Attackers do not need new tricks when old doors stay open. Verizon's 2026 Data Breach Investigations Report found that exploited software flaws are now the most common way into an organisation, ahead of stolen passwords.
In South Africa the cost of getting this wrong is high. Sophos's State of Ransomware in South Africa 2026 puts the average cost of recovering from an attack at about R17.7 million, before any ransom is paid. Sophos's regional head notes that attacks often begin with a weakness the business already knew about.
The POPIA angle: in 2026 the Information Regulator issued an enforcement notice against the SABS after a ransomware attack. The notice was not for being attacked. It was for what the attack exposed, including unpatched known vulnerabilities and no incident response plan.
Five things to do before 12 January
- Take stock. List every PC, laptop and server with its Windows and Office version. Include the forgotten ones: the reception PC, the accounting server, the machine running the access-control software.
- Decide each Windows 10 PC. Upgrade to Windows 11 where the hardware allows it. Where it does not, compare the doubled ESU price with the cost of a new device you will need by 2028 anyway.
- Replace Office 2021. Move those users to Microsoft 365 Apps, which keeps Outlook in step with Exchange Online and opens the door to newer features.
- Start on Windows Server 2016 now. Ten weeks is enough to upgrade, move a workload to the cloud or rebuild it on a supported server, but only if the work starts this month. December shutdowns eat into the window.
- Write down any exception. If a system must stay on old software, record why, what protects it (isolation, firewall rules, monitoring) and when it will be replaced. That record is your evidence of reasonable safeguards under POPIA.
Frequently asked questions
When does Windows Server 2016 support end?
On 12 January 2027. After that, Microsoft releases no further security updates for it unless you buy paid Extended Security Updates, which for servers on your own premises also require Software Assurance.
Will Office 2021 stop working?
No. Word, Excel and Outlook keep opening, but they no longer receive security fixes, and Office documents arrive by email all day.
Can we keep using Windows 10?
Only with paid Extended Security Updates, and the second year costs twice the first. For most business PCs, Windows 11 or a replacement device is the cheaper path.
Does unsupported software affect POPIA compliance?
It can. POPIA requires reasonable security safeguards for personal information, and the Information Regulator has cited unpatched systems in its enforcement action.
Book a free end-of-support check
ECOMX will list every Windows, Office and server version on your network, flag what is out of support or close to it, and give you a costed plan to fix it before 12 January. Clients on our managed IT support plans already have this tracked; if you run your own IT, we can also handle the server upgrades and cloud moves.
Sources
- Microsoft Lifecycle: products reaching end of support in 2026
- Windows Central: Windows Server 2016 end of support, 12 January 2027
- Notebookcheck: consumer Windows 10 updates extended to October 2027
- TimesLIVE: ransomware recovery costing SA organisations R17m on average
- Michalsons: Information Regulator ramps up enforcement
- Verizon: 2026 Data Breach Investigations Report