Microsoft is working to fix a Y2K22 bug in its FIP-FS anti-malware scanning engine that appears to be stopping Exchange on-premise servers from delivering email
Microsoft Exchange on-premise servers cannot deliver email starting on January 1st, 2022, due to a “Year 2022” bug in the FIP-FS anti-malware scanning engine.
Context & Ripple Effects
Exchange administrators had already spent 2021 addressing severe server flaws; Microsoft said 92% of vulnerable Exchange servers had been patched or mitigated, while warning that patching did not necessarily remove attacker access. The Y2K22 failure adds an availability problem to an installed base already under sustained maintenance pressure.
The immediate response moved quickly from diagnosis to a Microsoft emergency fix the following day, making restoration dependent on administrators applying vendor remediation rather than simply restarting mail flow.
First-order effects
- Organizations running on-premise Exchange face interrupted outbound email delivery until Microsoft’s FIP-FS fix is deployed.
- Microsoft must ship and support an emergency remediation for a defect in the anti-malware scanning engine, rather than a security vulnerability in Exchange itself.
Second-order effects
- Exchange administrators must prioritize another urgent maintenance action alongside the patching work prompted by the earlier Exchange security incidents.
- The outage makes the reliability of FIP-FS update and version-handling processes an operational concern for Exchange customers, not only a malware-protection feature.
Third-order effects
- Repeated urgent intervention around Exchange—first security patching and now an engine defect—raises the operational burden of self-managed email infrastructure relative to services where the provider applies fixes directly.
- If such incidents recur, enterprise messaging decisions will increasingly weigh remediation workload and service continuity alongside feature requirements.
The trend: Enterprise email operations are placing greater weight on the maintenance and continuity costs of self-managed Exchange deployments.