Microsoft blames AI for delayed Exchange update, can’t say when it will arrive

Microsoft has a fresh explanation for why Exchange Server Subscription Edition CU1 is late: AI found more bugs, and that created more work. The company said so in a post last Thursday headed “Where is Exchange SE CU1 anyway?”, which is a neat way of admitting customers have been asking where it is for a while.

Exchange SE is Microsoft’s subscription version of its email server, and a Cumulative Update is supposed to bundle recent fixes with other changes, including new features or the removal of old code. Microsoft usually ships these updates once or twice a year, so this is not some tiny patch drifting a few days behind schedule.

The company had previously said CU1 would land by the end of the first half of calendar year 2026, then pushed that out to the second half of 2026. Now it says the delay is tied to the extra reporting, validation, repro work, fixes, regression testing, and monthly security updates that came with Microsoft’s wider push to use AI tools to find vulnerabilities.

Microsoft also says it wants to “prioritize security above all else,” a line that carries some baggage after Exchange flaws were tied to an attack by suspected Chinese operatives and drew criticism from the US government. The Exchange team says it is folding monthly security payloads into its internal CU1 build and will release the update once it reaches a stable point and gets a month without a pressing security payload.

That sounds sensible right up until you remember what it means in practice: the company is trying not to ship CU1 and then immediately replace it with another update carrying new security fixes. Microsoft says that would mean extra work for admins and extra testing internally, because CU1 has to include everything released since RTM. The annoying part is that Microsoft still can’t give a date. Its final answer is basically: yes, CU1 is coming, no, there is no date, and no, AI was not supposed to make this harder.