This update applies to Windows Server 2025 Datacenter & Standard machines connected to Azure Arc. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows software updates.
To view the latest updates about this release, visit the Windows release health dashboard or the update history page for Windows Server 2025.
Note: Windows Server 2025 Datacenter & Standard machines connected to Azure Arc, now have the option to subscribe to Hotpatch servicing. Hotpatch provides the ability to install OS security updates without restarting your machine.
Announcements and messages
This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices.
Windows Secure Boot certificate expiration
Windows Secure Boot certificate expiration
Important: Secure Boot certificates used by most Windows devices have started expiring in June 2026. Microsoft has been updating these certificates on consumer and non-managed business devices for the past months. Devices that haven’t received the newer certificates will continue to start and operate normally, and standard Windows updates will continue to install. We will continue to install the newer certificates via Windows updates in the coming months.
You can check your PC status on the Windows Security app. If you are an IT administrator, follow the guidance on the Secure Boot Playbook for Windows clients and Windows Server.
Improvements and fixes
The following summary outlines key issues addressed by this update. The bold text within the brackets indicates the item or area of the change.
- [Windows Deployment Services] Fixed: After installing this security update, the Import-WdsInstallImage cmdlet requires administrator privileges. Attempts to run the cmdlet as a non-administrator fail with an ACCESS_DENIED error.
If you've already installed previous updates, your device will download and install only the new updates included in this package.
Known issues in this update
Windows Server Update Services (WSUS) does not display error details
After installing KB5070893 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
Windows Server 2025 servicing stack update (KB5131079) - 26100.33822
Microsoft now combines the latest servicing stack update (SSU) for your operating system with the Hotpatch update. SSUs improves the reliability of the update process and includes fixes to the servicing stack, the component that installs Windows updates. To learn more about SSUs, see Servicing stack updates.
How to get this update
Before you install this update
Baseline You must have baseline update KB5127648 installed before installing this update.
Servicing Stack Update (SSU): You must have installed servicing stack update version 26100.9703 or later before installing this update. To determine the latest SSU installed on your device, run
DISM /Online /Get-Packages | findstr /i "ServicingStack"from an elevated command prompt. The Package Identity line returned must be version 26100.9703 or later.If you are using Windows Update, the latest SSU installs with this update.
Install this update
To install this update, use one of the following Windows and Microsoft release channels.
| Available | Next Step |
|---|---|
|
This update downloads and installs automatically from Windows update. |
File information
A list of the files included in this update is provided in a CSV (comma-delimited) (.csv) file. You can open the file in a text editor, such as Notepad, or in Microsoft Excel.
Note: The English (United States) version of this software update might contain files for additional languages.
Download the file information for update KB5131077.
Download the file information for SSU KB5131079 - version 26100.33822.