Windows 11 and Server 2025 Hotpatch Baseline: October 2026 Restart Required

On October 13, 2026, Microsoft released its October 2026 security baseline under support advisory KB5131362. If your fleet is enrolled in hotpatching, consider this your friendly neighborhood operational wake-up call: the October 2026 Windows security update is shipping as a standard cumulative update rather than a rebootless hotpatch. Because several security improvements in this release modify core operating system components that cannot be patched in memory while running, every hotpatch-enrolled machine will require a full system restart to complete installation.

The Curious Case of the Crossed KB Numbers​

Before you start drafting maintenance window emails to your change-advisory board, we need to untangle a classic piece of Microsoft documentation confusion. If you read the official Microsoft Support notice for the October 13, 2026 baseline, you will immediately spot three conflicting pieces of metadata staring back at you:

• The Title and URL: The support page is titled October 13, 2026—Baseline (KB5131362) and lives under a /hotpatch/windows-11/ web path.
• The "Applies To" Tag: Despite the Windows 11 URL and a footer pointing to release notes for Windows 11 Enterprise versions 25H2 and 24H2, the page's official "Applies To" metadata lists Windows Server 2025 Datacenter: Azure Edition.
• The Body Text Reference: The body of the notice instructs administrators to "see KB5127648" for more information on the October 2026 security baseline.

So which operating system and which KB number are we actually talking about? A look at Microsoft's broader October 2026 release documentation and the Microsoft 365 Message Center archive (specifically announcement MC1506288) clears up the mystery.

In Microsoft's October 13, 2026 rollout, Baseline KB5131362 is designated for Windows 11 Enterprise LTSC 2024 (and the corresponding Windows 11 24H2/25H2 hotpatch baseline stream, whose underlying standard cumulative update is KB5127648). Meanwhile, Windows Server 2025 received its own standard LTSC cumulative update under KB5126646 (raising the OS build to 26100.33650), and Windows Server 2025 Datacenter: Azure Edition has its own distinct baseline advisory listed under KB5131334.

In short, Microsoft's support portal template cross-pollinated the "Applies To" field on the KB5131362 page with Windows Server 2025 Datacenter: Azure Edition, even though the URL, title, and KB5127648 cross-reference belong to the Windows 11 hotpatch baseline track. Regardless of whether you are managing Windows 11 Enterprise endpoints via Windows Autopatch or Windows Server 2025 nodes via Azure Update Manager, the operational reality on October 13, 2026 is identical: October is a mandatory Baseline (Restart) month across both client and server hotpatch calendars.

Summary: October 13, 2026 Baseline Identifiers​

Why Hotpatching Still Needs Quarterly Reboots​

Why can't Microsoft simply hotpatch every month of the year? To appreciate why baseline months exist, it helps to look under the hood of how Windows hotpatching works.

During a standard hotpatch month, Windows Update delivers a stripped-down, security-only payload that patches functions in memory without touching the underlying files locked on disk. Because the payload skips non-security quality fixes and feature additions, the package is significantly smaller, downloads faster, and takes effect immediately without interrupting active user sessions or server workloads.

However, two things eventually force a reboot:

1. Unpatchable Core Components: Certain deep kernel structures, boot-path binaries, and foundational system components cannot be safely swapped in memory while the operating system is running. As Microsoft's KB5131362 notice explicitly states, some of the security improvements in the October 2026 release modify components that cannot be updated without a restart.
2. Cumulative Feature and Quality Catch-Up: Because hotpatches only contain security fixes, devices need a periodic Latest Cumulative Update (LCU) to catch up on non-security bug fixes, servicing stack improvements, and new features.

By design, Microsoft structures the hotpatch calendar around four planned baseline months at the start of each quarter: January, April, July, and October. During those four months, devices receive a full cumulative baseline update and must reboot. During the remaining eight months (February–March, May–June, August–September, and November–December), devices on the current baseline receive rebootless hotpatches.

The 2026 Reality Check: When "Quarterly" Means Six Times a Year​

If you sold your CIO on hotpatching by promising that servers and enterprise PCs would only reboot four times a year, the 2026 release calendar has probably already given you a few gray hairs. Microsoft's documentation always places a quiet asterisk next to the word "quarterly": for critical security reasons, Microsoft can convert a planned hotpatch month into an unplanned baseline month that requires a restart. Crucially, when an out-of-cycle baseline occurs, it does not cancel the next scheduled quarterly baseline.

Look at how the 2026 hotpatch calendar actually played out for Windows Server 2025 (OS build 26100) according to Microsoft Learn's Windows Server release information:

• January 13, 2026: Planned Baseline (Restart) — Build 26100.32230 (KB5073379)
• February 10, 2026: Hotpatch — Build 26100.32313 (KB5075942)
• March 10, 2026: Hotpatch — Build 26100.32463 (KB5078736)
• April 14, 2026: Planned Baseline (Restart) — Build 26100.32690 (KB5082063)
• May 12, 2026: Hotpatch — Build 26100.32772 (KB5087423)
• June 9, 2026: Unplanned Baseline (Restart) — Build 26100.32995 (KB5094125)
• July 14, 2026: Planned Baseline (Restart) — Build 26100.33158 (KB5099536)
• August 11, 2026: Hotpatch — Build 26100.33222 (KB5120228)
• September 8, 2026: Unplanned Baseline (Restart) — Build 26100.33438 (KB5122871)
• October 13, 2026: Planned Baseline (Restart) — Build 26100.33650 (KB5126646)

Because both June and September 2026 required baseline restarts, October marks the fourth baseline reboot in the last five months, and the sixth baseline month of 2026 overall. The silver lining? Both November and December 2026 remain scheduled as rebootless hotpatch months on Microsoft's calendar—provided your machines successfully install and reboot for the October 13 baseline first.

Operational Guidance: Preparing Your Fleet for the October Baseline​

To qualify for the upcoming November and December hotpatches, your enrolled devices must be running the October 2026 baseline. Here is what administrators should verify across their Windows 11 and Windows Server 2025 environments right now.

1. Communicate the Restart Window​

Do not let your users or application owners assume that "Hotpatch Enabled" means "No Reboot in October." Your existing update rings, deferral timers, active hours, and deadline-driven installation policies in Microsoft Intune (via Windows Autopatch) or Azure Update Manager remain in full effect during baseline months. Make sure your maintenance schedules account for a full reboot cycle starting October 13, 2026.

2. Align OS Feature Upgrades with the Baseline Month​

If you are planning to move hotpatch-enrolled client PCs from Windows 11, version 24H2 to version 25H2 (especially since Windows 11 24H2 Home and Pro editions reach their end of updates on October 13, 2026 ), October is the ideal month to execute that upgrade. According to Microsoft's hotpatch deployment documentation, upgrading a device's Windows version during a baseline month keeps the device seamlessly on the hotpatch cycle. If you wait and upgrade during a hotpatch month like November, the device falls back to standard updates, requires a reboot, and won't resume hotpatching until the next baseline in January.

3. Verify Hotpatch Prerequisites for November​

Once the October baseline reboot is complete, double-check that your fleet remains eligible for next month's rebootless updates. Ineligible devices silently fall back to standard Latest Cumulative Updates (LCUs) every month.

• Virtualization-Based Security (VBS): VBS must be running for the hotpatch installer to function. You can verify this locally via System Information (msinfo32) by confirming that Virtualization-based security shows Running, or by checking Windows Autopatch alerts in Intune.
• Arm64 CHPE Restrictions: On Arm64 Windows 11 devices, Compiled Hybrid Portable Executable (CHPE) usage must be disabled for hotpatching to work, either via the DisableCHPE policy CSP or by setting HotPatchRestrictions=1 (DWORD) under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management. (Keep in mind that security updates for 32-bit Microsoft 365 Apps on Windows Arm devices end in December 2026 anyway.)
• Event Viewer Verification: On client devices, you can confirm active hotpatch policy enrollment by opening Event Viewer and filtering for AllowRebootlessUpdates—an enrolled machine will report "Update/AllowRebootlessUpdates":true and "isEnrolled": 1.

Hotpatching remains one of the best quality-of-life improvements Microsoft has brought to Windows servicing, even in a year where out-of-band security needs forced extra baseline reboots. Get the October 13, 2026 baseline installed, survive the mandatory restart, and your fleet will be primed and ready for a quiet, reboot-free November and December.