Microsoft Delays Exchange CU1 Again as AI Scanning Uncovers More Security Flaws
Updated
Updated · Computerworld · Aug 17
Microsoft Delays Exchange CU1 Again as AI Scanning Uncovers More Security Flaws
3 articles · Updated · Computerworld · Aug 17
Summary
Microsoft has postponed the first Cumulative Update for Exchange Server Subscription Edition for a second time and gave no new release date after previously shifting it from the first half to the second half of 2026.
AI-assisted code scanning surfaced a growing backlog of potential vulnerabilities, forcing engineers to validate, reproduce, fix and regression-test findings before shipping the larger update.
Monthly Exchange security updates are still arriving on schedule, but CU1 is a broader package that can include bug fixes, security changes and feature updates, requiring heavier enterprise compatibility testing before deployment.
Nord-IQ analyst Manoj Chandra Jha said enterprises should stop waiting for a CU1 date, use the monthly patch cadence as their baseline, and keep test environments and change approvals ready for a fast rollout.
The delay highlights a wider AI bottleneck across software teams, with GitHub, AWS and CodeRabbit all adding tools this year to cope with surging volumes of AI-generated code and security reports.