September 9, 2025 Hotpatch KB5065474 (OS Build 26100.6508) for Windows Server 2025

Summary

This is a hotpatch security update for Windows Server 2025 Datacenter: Azure Edition, released on September 9, 2025, bringing the OS to build 26100.6508. It applies to machines connected to Azure Arc and delivers a targeted fix for unexpected UAC prompts triggered during MSI repair operations. Hotpatch updates install without requiring a system restart. Source: Microsoft Support.

Improvements and fixes

• UAC prompt fix for MSI installers: Addresses a problem where non-admin users received unexpected User Account Control prompts when MSI installers performed certain custom actions - such as configuration or repair operations running in the foreground or background during an application's initial installation. The issue blocked non-admin users from running apps that perform MSI repairs, including Office Professional Plus 2010 and several Autodesk products such as AutoCAD. This fix narrows the conditions under which UAC prompts appear for MSI repairs and gives IT admins a way to suppress UAC prompts for specific applications by adding them to an allowlist.

Known issues

PSDirect connections failing in hotpatched devices

Symptom: Hotpatched devices that have installed the September 2025 Hotpatch update (KB5065474) or the September 2025 security update (KB5065426) may experience failures with PowerShell Direct (PSDirect) connections when the host and guest virtual machines are not both fully updated. When a patched guest VM attempts to connect to an unpatched host, or vice versa, the expected fallback to a legacy handshake and graceful socket cleanup fails intermittently. Connection failures may appear random, and Event ID 4625 may be logged in the Security Event log within Windows Event Viewer.

Workaround: This issue is addressed in KB5066360. If a hotpatched device is experiencing PSDirect connection failures, Microsoft recommends updating both the host and guest VM with that update.

How to get this update

Before installing, note that Microsoft now combines the latest servicing stack update (SSU) for the operating system with the hotpatch update. The SSU for this release is KB5064531 at version 26100.5074. When using Windows Update, the latest SSU installs automatically alongside this update.

This update is available through the following channels:

• Windows Update and Microsoft Update - downloads and installs automatically.
• Windows Update Catalog - available for manual download and deployment.
• Windows Server Update Services (WSUS) - available for enterprise distribution.

For a full list of files in this update, Microsoft provides downloadable file information for cumulative update KB5065474 and separately for the SSU (KB5064531).

Frequently asked questions

What is hotpatch servicing and who can use it?

Hotpatch servicing lets administrators install OS security updates without restarting the machine. It is available for Windows Server 2025 Datacenter and Standard machines connected to Azure Arc. This can reduce planned downtime associated with monthly security patching cycles.

Does this update address the Secure Boot certificate expiration issue?

The page notes that Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft is distributing updated certificates through Windows Update over the coming months. Devices that have not yet received newer certificates will continue to start and operate normally, and standard Windows updates will continue to install in the meantime.

Which applications were affected by the UAC prompt issue fixed in this update?

The issue affected non-admin users running applications that trigger MSI repair operations. Confirmed affected products include Office Professional Plus 2010 and multiple Autodesk applications including AutoCAD. The fix reduces the scope of UAC prompts for MSI repairs and adds an allowlist mechanism for IT admins.

Is a system restart required to apply this hotpatch update?

No. Hotpatch updates are specifically designed to install OS security updates without requiring a machine restart, which is a key benefit for environments where uptime is critical. The latest SSU is bundled with the update and installs automatically when the update is applied via Windows Update.