Windows Server 2022 Hotpatching Extended to October 2027

Did Microsoft really extend Windows Server 2022 hotpatching to 2027?

Yes. In late June 2026 Microsoft confirmed it will keep delivering hotpatch updates for Windows Server 2022 Datacenter: Azure Edition through October 2027 — a full year past the original October 2026 cutoff. The change took effect immediately, the existing patch cadence stays the same, and enrolled servers keep getting monthly security updates without a reboot each time.

The catch is in the edition name. This extension is for Azure Edition systems already enrolled in hotpatch updates — not the on-premises Standard or Datacenter SKUs most self-hosted websites run on. If you operate a Windows-based site or app, the practical question isn't just "can I skip reboots," it's "which version am I actually running, and what does my reboot and security schedule look like for the next 18 months?" That's where this announcement matters, and where most coverage stops short of the detail you need.

What exactly changed, and which versions qualify?

Hotpatching has always been a narrow feature. It launched for Windows Server 2022 Datacenter: Azure Edition back in February 2022 and was never offered on the boxed on-premises editions. The 2027 extension simply buys Azure Edition users another year before they're pushed toward Windows Server 2025. Here's how the support picture lines up.

The headline for self-hosters: if you're on a standard on-premises Windows Server 2022 license, this announcement changes nothing for you directly. You still patch through the regular channel and reboot accordingly, and your real deadline is the 2031 extended-support end, not 2026 or 2027. The extension is genuinely useful only if your provider runs Azure Edition under the hood.

How does hotpatching actually work, and why do reboots still happen?

Hotpatching applies security fixes directly to the in-memory code of running processes, so the system gets protected without restarting after each update. That's the uptime win. But it doesn't eliminate reboots entirely — and the part most summaries gloss over is the baseline cycle.

Hotpatch runs on a quarterly rhythm. Each three-month block starts with a baseline month — a full cumulative update that does require a reboot — followed by two months of hotpatches that don't. Over a year that's four scheduled reboots (typically January, April, July, October) and up to eight reboot-free hotpatch months.

• Reboots drop from ~12 a year to ~4. You're not reboot-free, you're reboot-light.
• Faster vulnerability response. Critical fixes land on running processes without waiting for a maintenance window.
• Out-of-band updates can still force a restart. If Microsoft ships an emergency fix outside the hotpatch stream, or a non-hotpatch update arrives, a reboot is back on the table.

Hotpatching is best understood as fewer, more predictable reboots — not zero reboots. The value is a tighter security window and quarterly maintenance instead of monthly fire drills.

For a busy site, that predictability is the real prize. Knowing reboots cluster into four planned baseline windows lets you schedule downtime around traffic lows instead of reacting to a patch every month.

What does this mean if you host a website on Windows?

If you run a Windows-based site — an ASP.NET app, a legacy IIS workload, or a SQL Server backend — patch cadence directly shapes your uptime and your exposure window. Three practical takeaways:

First, confirm what your host actually runs. Ask your provider whether your Windows VPS or dedicated server is Datacenter: Azure Edition, plain Datacenter, or Standard. The hotpatch extension only helps the first group. Many budget Windows VPS plans run Standard, where every Patch Tuesday still means a reboot.

Second, plan around baseline months even if you do have hotpatch. Schedule any risky deployments away from January, April, July and October baseline windows so a forced reboot doesn't collide with your own changes.

Third, weigh whether you need Windows at all. A large share of websites — WordPress, most PHP, Node, Python and static sites — run perfectly on Linux, which sidesteps Windows licensing, reboot scheduling, and per-core hotpatch fees completely. Live kernel patching tools like kpatch and Ksplice bring similar reboot-free security updates to Linux without a subscription bolt-on. LaunchPad Host runs its hosting on hardened Linux precisely so customers get fast, reboot-light security maintenance without inheriting Windows Server's licensing and patch-cadence overhead.

Windows Server 2025 hotpatching now costs money — should you wait?

The 2027 extension is partly a courtesy because the successor isn't free anymore. Starting July 1, 2025, hotpatching on Windows Server 2025 in on-premises and non-Azure environments became a paid subscription at $1.50 per CPU core per month. Azure Edition still includes it at no cost. Billing is monthly and flat, so you pay the same in baseline and hotpatch months alike.

That per-core model adds up fast on modern hardware. Run the numbers before you assume reboot-free patching is worth it.

For a high-core dedicated box, that's a four-figure annual line item purely for the convenience of fewer reboots. Whether it's worth it depends on how costly downtime is for you. A revenue-critical app with strict SLAs may find $1,152 a year trivial; a hobby project or internal tool almost certainly won't. What most hosts won't tell you is that for many workloads the smarter move is a well-architected high-availability setup — load-balanced nodes you can patch and reboot one at a time — which delivers zero user-facing downtime without any hotpatch fee at all.

Do you actually need Windows hosting in 2026?

The reboot-and-licensing math is a good prompt to ask a more basic question: does your workload genuinely require Windows Server? It does if you depend on .NET Framework (not just modern cross-platform .NET), IIS-specific features, Active Directory, MSSQL with Windows-only tooling, or commercial software that ships Windows-only. If none of that applies, Linux is usually cheaper, lighter, and free of the patch-subscription question entirely.

When Windows hosting makes sense

• Legacy ASP.NET / .NET Framework apps tied to IIS.
• SQL Server workloads using Windows-only management tooling.
• Software with hard Windows-only dependencies you can't replace.

When Linux is the better call

• WordPress, Laravel, and the broad PHP ecosystem.
• Node.js, Python, Ruby, Go, and most modern web stacks.
• Static sites, JAMstack, and container-based deployments.

Beyond cost, your hosting choice is also a control-and-privacy decision. Where your server physically sits determines which jurisdiction's data and disclosure rules apply, and a legitimate privacy-forward or offshore host can give you stronger data sovereignty, WHOIS privacy on domains, and crypto-friendly billing — all while staying fully within lawful acceptable-use boundaries. LaunchPad Host focuses on exactly that: privacy-aware, offshore-friendly Linux hosting and domains for people who want performance and discretion without the Windows licensing treadmill. Keep your acceptable-use policy in mind whichever route you pick — privacy hosting protects lawful free expression and security, not abuse.