November 11, 2025—Hotpatch KB5068966 (OS Build 26100.7092)

This update applies to Windows Server 2025 Datacenter & Standard machines connected to Azure Arc. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows software updates.

To view the latest updates about this release, visit the Windows release health dashboard or the update history page for Windows Server 2025.

Note: Windows Server 2025 Datacenter & Standard machines connected to Azure Arc, now have the option to subscribe to hotpatch servicing. Hotpatch provides the ability to install OS security updates without restarting your machine.

Announcements and messages

This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices.

Windows Secure Boot certificate expiration

Important: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. This might affect the ability of certain personal and business devices to boot securely if not updated in time. To avoid disruption, we recommend reviewing the guidance and taking action to update certificates in advance. For details and preparation steps, see Windows Secure Boot certificate expiration and CA updates.

Improvements and fixes

This security update includes quality improvements. The following summary outlines key issues addressed by this update. The bold text within the brackets indicates the item or area of the change.

This update makes miscellaneous security improvements to internal OS functionality. No additional issues were documented for this release.

If you've already installed previous updates, your device will download and install only the new updates included in this package.

Known issues in this update

After installing KB5070893 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.

Symptoms

The out-of-band update for Windows Server 2025 (KB5070881) was briefly offered to all Windows Server 2025 machines, regardless of Hotpatch enrollment.

Machines that installed KB5070881 will temporarily stop receiving Hotpatch updates and will instead receive security updates that require a restart.

Workaround

Machines affected by this issue will resume receiving Hotpatch updates after installing the next baseline update in January 2026. The next planned Hotpatch update will be offered in February 2026.

How to get this update

Before you install this update

Microsoft now combines the latest servicing stack update (SSU) for your operating system with the hotpatch update. For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions.

If you are using Windows Update, the latest SSU installs with this update.

Install this update

To install this update, use one of the following Windows and Microsoft release channels.