February 10, 2026 Hotpatch KB5077212 (OS Builds 26200.7781 and 26100.7781)
Hotpatch KB5077212 delivers miscellaneous security improvements to internal OS functionality for Windows 11 Enterprise LTSC 2024, released February 10, 2026.
Summary
This is a Hotpatch security update for Windows 11, version 25H2 and 24H2, released on February 10, 2026, producing OS Builds 26200.7781 and 26100.7781. It applies to Windows 11 Enterprise LTSC 2024 and delivers miscellaneous security improvements to internal OS functionality. Source: Microsoft Support.
Improvements and fixes
- Miscellaneous security improvements have been made to internal OS functionality for both x64 and Arm64 architectures.
Known issues
Microsoft lists no known issues for this update at the time of writing.
Note: A known issue titled "Reset this PC might fail with the March 2026 Hotpatch security update or later" was originally documented under this update but was removed on April 10, 2026.
How to get this update
Before installing, be aware that Microsoft bundles the latest servicing stack update (SSU) with the hotpatch package. If you use Windows Update, the SSU installs automatically alongside this update. The associated SSU is KB5077869, version 26100.7839.
Installation channels:
- Windows Update / Microsoft Update - the update downloads and installs automatically.
- Microsoft Update Catalog - available for manual download.
- Windows Server Update Services (WSUS) - available through the standard WSUS pipeline.
File information for the cumulative update (KB5077212) and the SSU (KB5077869, version 26100.7839) can be downloaded from Microsoft Support.
Arm64 prerequisites
Hotpatch is now generally available for Windows 11, version 25H2 and 24H2 on Arm64 devices. To use it, devices must meet these requirements:
- Windows 11 Enterprise, version 25H2 or 24H2 (Build 26100.4929 or later) with the current baseline update installed.
- Microsoft Intune with a Hotpatch-enabled Windows quality update policy.
- An eligible license: Windows 11 Enterprise E3 or E5, Microsoft 365 F3, Windows 11 Education A3 or A5, Microsoft 365 Business Premium, or Windows 365 Enterprise.
- Virtualization-based security (VBS) enabled.
- Compiled Hybrid PE (CHPE) disabled.
To disable CHPE, apply the CSP setting ./Device/Vendor/MSFT/Policy/Config/Hotpatch/DisableCHPE = 1 via Intune or Group Policy, or set the registry key HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\HotPatchRestrictions to 1, then restart the device once. After that, enroll devices through the Microsoft Intune admin center under Devices > Windows updates > Quality updates, ensuring the "When available, apply without restarting the device" option is set to Allow.
Announcements
Microsoft has flagged an important notice about Secure Boot certificate expiration. Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed business devices over recent months. Devices that have not yet received the newer certificates will continue to start and operate normally, and standard Windows updates will continue to install. Microsoft will continue to push the newer certificates through Windows Update in the coming months. IT administrators should consult the Secure Boot Playbook for Windows clients and Windows Server, and end users can check their PC status in the Windows Security app.
Frequently asked questions
What does a Hotpatch update do differently from a standard cumulative update?
A Hotpatch update applies security and quality improvements to running processes in memory without requiring a device restart at installation time. This reduces disruption for end users and helps organizations maintain higher uptime. The device still needs periodic restarts for baseline updates, but in-between Hotpatch cycles avoid mandatory reboots.
Is KB5077212 available for all Windows 11 editions?
No. According to Microsoft, this update applies specifically to Windows 11 Enterprise LTSC 2024. Hotpatch functionality also requires an eligible license - Windows 11 Enterprise E3 or E5, Microsoft 365 F3, Windows 11 Education A3 or A5, Microsoft 365 Business Premium, or Windows 365 Enterprise.
Do Arm64 devices need any special configuration before enrolling in Hotpatch?
Yes. Arm64 devices must have Compiled Hybrid PE (CHPE) disabled before Hotpatch can function. This is a one-time setup step performed via a CSP policy in Microsoft Intune, a Group Policy setting, or a registry key change, followed by a single device restart. After that, the device can be enrolled in a Hotpatch-enabled quality update policy.
What happens if a device has not yet received the updated Secure Boot certificates?
Microsoft states that devices lacking the newer Secure Boot certificates will continue to start and operate normally. Standard Windows updates will continue to install on those devices, and Microsoft will keep distributing the updated certificates through Windows Update in the coming months. IT administrators managing fleets should follow the Secure Boot Playbook guidance.
