Exchange Server 2013 enters the Extended Support phase of product lifecycle on April 10th, 2018. During Extended Support, products receive only updates defined as Critical consistent with the Security Update Guide. For Exchange Server 2013, critical updates will include any required product updates due to time zone definition changes.
With the transition of Exchange Server 2013 to Extended Support, the quarterly release schedule of cumulative updates will end. The last planned cumulative update for Exchange Server 2013, Cumulative Update 21, will be released in June 2018. Microsoft may at its discretion release a future cumulative update to aggregate previously released critical updates or to address unforeseen future O365 Hybrid connectivity requirements. At this time there is no explicit plan to exercise releasing future cumulative updates.
Microsoft encourages Exchange Server 2013 customers to adopt Cumulative Update 21 as soon as possible to ensure uninterrupted delivery of any future security related fixes. This includes customers who may still be running Exchange Server 2013 Service Pack 1. After September 19th 2018, only Cumulative Update 21 or its successors will receive critical updates. During the Extended Support phase, only the latest cumulative update is eligible to receive critical updates once the standard 3 month transition period of the prior cumulative update has lapsed.
Critical updates will continue to be made available via Windows Update and the Microsoft Download Center. Additional lifecycle information for all Microsoft products is available on support.microsoft.com.