CybersecurityVulnerability Management

Microsoft Warns of Impending Windows Server 2016 Support Expiration

Analyst 207||Source: BleepingComputer

"The January 2027 Windows security update will be the last update available for this version. After this date, devices running Windows Server 2016 will no longer receive monthly security updates containing protections from the latest security threats," Microsoft said in a message center update.

Microsoft sets January 12, 2027 cutoff for Windows Server 2016

Microsoft confirmed that extended support for Windows Server 2016 will end on January 12, 2027. After the January 2027 security update, Microsoft said, "devices running Windows Server 2016 will no longer receive monthly security updates containing protections from the latest security threats." The company described the January update as the last available for this version.

Windows Server 2016: release and lifecycle dates

Windows Server 2016 was introduced at Microsoft's annual Ignite conference in September 2016 and reached general availability on October 12, 2016. It reached the end of mainstream support in January 2022, and extended support will cease on January 12, 2027—roughly three months from Microsoft's announcement. Microsoft specified that the end-of-updates date applies to all editions of Windows Server 2016: Datacenter, Essentials, MultiPoint Premium and Standard.

Windows Server 2016 Essentials features also end support on January 12, 2027

Microsoft noted that, on the same date, it will stop support for all Windows Server 2016 Essentials features, including Remote Web Access and related Essentials-specific functionality. Organizations that rely on Essentials-specific services will need to plan migrations or alternative arrangements before the January cutoff if they require continued vendor-supported functionality.

Microsoft's recommended migration: Windows Server 2025

Microsoft advised administrators to upgrade to Windows Server 2025. According to the company, Windows Server 2025 began rolling out to Windows Insiders in January 2024 and reached general availability in November 2024. Microsoft described Windows Server 2025 as the latest Long-Term Servicing Channel (LTSC) release for Windows Server and detailed its support timeline: mainstream support through November 2029, followed by five years of extended support until November 14, 2034.

For those who want to test before deploying, Microsoft offers a free 180-day trial of Windows Server 2025 via the Microsoft Evaluation Center. Microsoft also pointed readers to its Windows Lifecycle FAQ page and the Lifecycle Policy search tool for more servicing-date information.

What this means for IT administrators, trial evaluators, and Essentials customers

  • IT administrators: Microsoft explicitly advised planning upgrades to Windows Server 2025 to "help keep your environment protected and supported." Admins managing Server 2016 estates should schedule migrations ahead of January 12, 2027 to maintain monthly security updates and vendor support.
  • Trial evaluators and early adopters: A free 180-day Windows Server 2025 trial is available via the Microsoft Evaluation Center, enabling testing before full deployment.
  • Organizations using Essentials features: Customers that depend on Remote Web Access and other Essentials-specific functionality need to address the termination of those features on January 12, 2027—either by migrating to supported editions or adopting alternate solutions.

Microsoft's notice arrives amid broader product servicing shifts: earlier this month the company announced that systems running Windows 11 24H2 Home and Pro editions stopped receiving security and non-security preview updates and advised customers to upgrade to Windows 11 26H2 (the Windows 11 2026 Update). The company also highlighted security measurement work, noting that "Overall prevention scores can hide what happens after initial access" and that the Blue Report 2026 "measures defenses technique by technique across 338 million simulations run in customer production environments."

For organizations still on Windows Server 2016, the clear next step Microsoft provided is an orderly migration to Windows Server 2025 or another supported platform before January 12, 2027. Microsoft’s lifecycle pages and the Evaluation Center are the company’s pointed tools for planning that migration and testing replacements before the extended support window closes.

Original story

Emerging ThreatsMicrosoftServer SecurityWindows Server 2016End Of LifeSupport Expiration
Related Intelligence

Continue Reading

Ruby Fixes Regex Engine Bugs Behind GitLab RCE Flaws

GitLab users, beware: a critical vulnerability in Ruby's regex engine, patched in versions 4.0.9, 3.4.12, and 3.3.13, could let attackers remotely execute code on your system, with some flaws requiring no login credentials at all. The CVE-2026-110264 bug alone affects every GitLab release from 7.0 onward.

Analyst 207
Blurry signature and seal on a certificate in a dimly lit office with natural daylight streaming in.

Weak Private Keys Compromise Indian TLS Certificates

A shocking security lapse has been uncovered in Indian TLS certificates issued by eMudhra Limited, with eight certificates found to have private keys ridiculously small, ranging from 4 to 237 in size. This elementary mistake has left experts stunned, wondering how such a basic error could have occurred.

Analyst 207
Rows of servers and cables in a network operations center with a hint of vulnerability.

PHP Discloses Mitigation for Unpatched RCE Vulnerability

With over 5.1 million PHP hosts online and 3.8 million vulnerable to attack, a newly disclosed remote code execution flaw, CVE-2026-115560, has prompted the PHP security team to share mitigation steps - despite there being no patch available yet. This unusual configuration-dependent flaw requires a specific setup to be exploited, but experts say it's worth watching due to its potential impact.

Analyst 207
Researchers work in a lab with a laptop displaying abstract data blocks.

Gen Builds Trust Layer to Secure AI Agents from Hidden Threats

Imagine an AI agent being manipulated into executing system commands, transmitting sensitive data, or performing destructive file operations - all without a software vulnerability in sight. Gen Digital's researchers have just demonstrated how easily this can happen when agents treat untrusted content as instruction.

Analyst 207