KB5058500 Hotpatch for Windows Server 2022 Datacenter Azure Edition (OS Build 20348.3630)

Summary

KB5058500 is a hotpatch security update for Windows Server 2022 Datacenter: Azure Edition, released on May 13, 2025, bringing the OS to build 20348.3630. Delivered through Windows Update, WSUS, and the Microsoft Update Catalog, it addresses miscellaneous internal OS security improvements. Full details are available at Microsoft Support.

Improvements and fixes

• Internal OS security: This update makes miscellaneous security improvements to internal OS functionality. Microsoft notes there are no additional issues documented in this release beyond this change.

Known issues

Microsoft lists no known issues for this update at the time of writing.

How to get this update

Before installing KB5058500, note that Microsoft now combines the latest servicing stack update (SSU) with the hotpatch package. If you use Windows Update or Windows Server Update Services (WSUS), the SSU installs automatically alongside this update. The associated SSU is KB5058531, version 20348.3691.

The update is available through the following channels:

• Windows Update / Microsoft Update - downloads and installs automatically.
• Microsoft Update Catalog - available for manual download.
• Windows Server Update Services (WSUS) - syncs automatically when Products and Classifications are configured as follows: Product set to Server 2022 Hotpatch Category, Classification set to Security Updates.

For a full list of files included in the cumulative update, download the file information for KB5058500. For files in the servicing stack update, download the file information for SSU KB5058531.

Frequently asked questions

What is a hotpatch update and how does it differ from a standard cumulative update?

A hotpatch update applies security fixes to running processes in memory, eliminating the need for an immediate restart in most cases. It targets Windows Server 2022 Datacenter: Azure Edition specifically. Standard cumulative updates replace binaries on disk and typically require a reboot before changes take effect.

Does this update require a servicing stack update to be installed first?

Microsoft now bundles the latest SSU directly with the hotpatch package. If you deploy via Windows Update or WSUS, the SSU - KB5058531, version 20348.3691 - installs automatically. No separate pre-installation step is required when using those channels.

Which WSUS product and classification settings are needed to receive this update?

In your WSUS configuration, set the Product to Server 2022 Hotpatch Category and the Classification to Security Updates. With those settings in place, KB5058500 syncs to your WSUS server automatically and can be approved for deployment to eligible systems.

Does installing this update download files already delivered by earlier updates?

No. If earlier updates are already installed on the target system, only the new content contained in this package is downloaded and applied. This keeps bandwidth usage and installation time to a minimum across managed environments.