August 12, 2025 Hotpatch KB5064010 (OS Build 26100.4851) for Windows Server 2025
August 12, 2025 hotpatch for Windows Server 2025 Datacenter: Azure Edition, delivering miscellaneous OS security improvements at OS Build 26100.4851 without requiring a restart.
Summary
This is a hotpatch security update for Windows Server 2025 Datacenter: Azure Edition, released on August 12, 2025, bringing the OS to build 26100.4851. It applies to Windows Server 2025 Datacenter and Standard machines connected to Azure Arc and delivers miscellaneous internal OS security improvements. Hotpatch lets administrators install security updates without restarting the machine. See Microsoft Support for the official page.
Improvements and fixes
- This update delivers miscellaneous security improvements to internal OS functionality. Microsoft states there are no additional issues documented in this release beyond those security improvements.
- If earlier updates have already been installed, the device downloads and installs only the new content contained in this package, avoiding redundant downloads.
Known issues
Microsoft lists no known issues for this update at the time of writing.
How to get this update
Before installing, be aware that Microsoft now bundles the latest servicing stack update (SSU) with the hotpatch package. The SSU for this release is KB5065381, version 26100.4933. If you are applying this update through Windows Update, the SSU installs automatically alongside it.
This update is available through the following channels:
- Windows Update and Microsoft Update - the update downloads and installs automatically.
- Windows Update Catalog - available for manual download and deployment.
- Windows Server Update Services (WSUS) - available for organizations managing updates centrally.
A full list of files included in cumulative update KB5064010, as well as the SSU file list, can be downloaded from the Windows Update Catalog file information pages.
Frequently asked questions
What is hotpatch servicing and who can use it?
Hotpatch servicing lets eligible machines receive OS security updates without requiring a system restart. According to Microsoft, Windows Server 2025 Datacenter and Standard machines connected to Azure Arc now have the option to subscribe to hotpatch servicing, reducing disruption for workloads that require high availability.
Does this update require a manual servicing stack update first?
No. Microsoft now combines the latest SSU with the hotpatch package. When applying this update through Windows Update, the SSU - identified as KB5065381 at version 26100.4933 - installs automatically. Administrators deploying through the Update Catalog or WSUS should confirm the SSU is included or applied separately.
What is the Secure Boot certificate expiration issue mentioned on the page?
Microsoft notes that Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Devices that have not yet received the newer certificates will continue to start and operate normally, and standard Windows updates will keep installing. Microsoft is continuing to push updated certificates through Windows Update and advises IT administrators to follow the Secure Boot Playbook for Windows clients and Windows Server.
How can administrators confirm their environment is up to date after applying this update?
After installation, the OS build should report as 26100.4851. Administrators can verify device Secure Boot certificate status through the Windows Security app. For broader deployment status, Microsoft recommends monitoring the Windows Release health dashboard via the @WindowsUpdate channel for the latest release information.
