Dealing with machine-made bug backlog makes it hard to find a moment to deliver promised subscription service<\/p>\n
Microsoft has blamed extra work created by AI bug-finders for the delayed release of a major Cumulative Update to Exchange Server Subscription Edition (SE).<\/p>\n
Redmond\u2019s Exchange team made that admission last Thursday in a post titled \u201cWhere is Exchange SE CU1 anyway?\u201d that reveals the software giant is \u201cgetting questions from our customers on when they can expect us to release Exchange SE Cumulative Update 1 (CU1).\u201d<\/p>\n
\u201cAfter all, in the past we mentioned that it would be released by the end of the first half of calendar year 2026, later updated to \u2018second half of 2026\u2019. What is the deal? Where is CU1?\u201d<\/p>\n
For those of you who came in late, Exchange SE is the subscription version of Microsoft\u2019s email server, and a Cumulative Update (CU) is a new version of the package that includes all recent bug fixes, plus other changes such as new features or removing deprecated code. Microsoft publishes CUs once or twice a year. Some users prefer applying CUs to applying every patch.<\/p>\n
As Exchange SE is a subscription product, not getting CU in a timely fashion isn\u2019t a great example of why pay-as-you-go software is a great idea.<\/p>\n
Microsoft explained delays to the arrival of CU1 by referring to the fact that \u201cOver the last few months, various Microsoft execs made statements explaining how Microsoft is leveraging a variety of AI tools to help find vulnerabilities in our products.\u201d<\/p>\n
The post says the Exchange development team is \u201cworking through reported issues \u2013 which includes validation that they are real security issues, reproducing, fixing, testing for regressions \/ issues after fixes are deployed and releasing updates monthly.\u201d<\/p>\n
Redmond\u2019s missive also points to Microsoft\u2019s pledge to \u201cprioritize security above all else\u201d as a reason for delays. A reminder: Microsoft adopted that stance after flaws in Exchange led to an attack on Exchange by suspected Chinese operatives, earning it a tongue-lashing from the US government.<\/p>\n
The Exchange team says that while trying to stay on top of bugs, it is also working on CU1.<\/p>\n
\u201cWe are regularly rolling our monthly security payload into our internal CU1 build and plan to release Exchange SE CU1 as soon as we get a reasonable stable point and have a month without pressing security payload.\u201d<\/p>\n
The Exchange team has adopted that stance because it doesn\u2019t want to publish CU1 and then find it needs to replace it with another that includes new security updates.<\/p>\n
\u201cThat would create double the update work for many organization administrators,\u201d the post explains. \u201cEven internally, trying to ensure that two major releases (Security Update and a CU) get appropriately tested so we can ensure high quality and nothing falls through the cracks would be very challenging as CU1 must be all inclusive of everything that we released since the RTM.\u201d<\/p>\n
Exchange admins will likely appreciate the fact that Microsoft doesn\u2019t want to burden them with two major updates to implement. They may also wonder when Microsoft will find a month in which there is no \u201cpressing security payload\u201d that takes priority over CU1.<\/p>\n
Microsoft\u2019s post offers little certainty because it concludes: \u201cIn short: Exchange SE CU1 is coming; we do not have a date to give you. But we did not forget about it.\u201d<\/p>\n