CybersecurityVulnerability Management

Microsoft Winds Down Support for Windows Server 2022

Analyst 207||Source: BleepingComputer
Rows of rack-mounted servers and storage systems in a softly lit data center.
"As of October 13, 2026, Windows Server 2022 has reached end of mainstream support and transitioned to extended support. The October 2026 security update is the last mainstream support update available for this version," Microsoft said.

Microsoft's announcement and the Windows Server 2022 lifecycle

Microsoft announced that Windows Server 2022 has entered extended support as of October 13, 2026. The company noted that Windows Server 2022 was unveiled in March 2021 and made generally available in September 2021 as a Long-Term Servicing Channel (LTSC) release with 10 years of support. With the transition, the October 2026 security update is the final mainstream support update for this version.

Extended support, hotpatching, and update cadence

Under extended support, Microsoft will continue to provide security updates at no additional cost. The company specified that Windows Server 2022 will receive monthly security updates through October 14, 2031. Separately, Microsoft extended hotpatching for certain systems: hotpatching support continues until October 2027 for systems running the Datacenter: Azure Edition — one year beyond the mainstream end date of October 2026.

Microsoft's upgrade path: Windows Server 2025

Microsoft advised IT administrators to upgrade to Windows Server 2025 before Windows Server 2022 reaches the end of support. According to the announcement, Windows Server 2025 began rolling out to Windows Insiders in January 2024 and reached general availability in November 2024. Microsoft described Windows Server 2025 as the latest LTSC release and recommended planning an upgrade path to that version for full mainstream support.

The lifecycle platform entry cited by Microsoft shows Windows Server 2025 will reach its end of mainstream support in November 2029, followed by an additional five years of extended support until November 14, 2034. For teams that want to test before deployment, Microsoft pointed to a free 180-day Windows Server 2025 trial available via the Microsoft Evaluation Center and additional servicing dates available on the Windows Lifecycle FAQ page or via the Lifecycle Policy search tool.

Windows 11 24H2 advisory and certificate-rotation warning

On the same day, Microsoft announced that devices running Windows 11 24H2 Home and Pro editions no longer receive security and non-security preview updates, and advised customers to upgrade to Windows 11 26H2 (the Windows 11 2026 Update). The company also warned — in a notice issued "last week" relative to this announcement — that users of unsupported Windows versions should upgrade because those devices will stop receiving security updates after next year's Windows Update certificate rotation.

What this means for IT admins, enterprises, and end users

  • IT administrators: Microsoft explicitly advised planning an upgrade path to Windows Server 2025 to remain on full mainstream support; teams should note that October 2026 delivered the last mainstream security update for Server 2022 and that monthly security updates will continue under extended support through October 14, 2031. Datacenter: Azure Edition customers should be aware hotpatching is available through October 2027.
  • Enterprises and procurement leaders: Lifecycle end dates for Windows Server 2022 and Windows Server 2025 are now fixed in Microsoft’s lifecycle platform — factor the October 14, 2031 and November 14, 2034 extended-support cutoffs, respectively, into sourcing and upgrade budgets and timelines.
  • End users and desktop administrators: Devices on Windows 11 24H2 Home and Pro no longer receive preview updates; Microsoft recommended moving to Windows 11 26H2. Organizations should also account for Microsoft's warning about Windows Update certificate rotation next year, which will affect unsupported Windows versions' update delivery.

Microsoft’s October 13, 2026 bulletin closes one chapter for Windows Server 2022 and sets clear, dated milestones for the next. The specifics matter: October 2026 delivered the last mainstream patch, hotpatching is extended only for Datacenter: Azure Edition through October 2027, and monthly security updates continue under extended support until October 14, 2031. The practical question left for every IT organization is whether they can execute the recommended upgrade path to Windows Server 2025 and, for Windows 11 users, to 26H2, in time to avoid gaps tied to update-delivery changes such as the certificate rotation next year.

Original story

MicrosoftWindows Server 2022Extended SupportEnd Of SupportLong-Term Servicing ChannelLTSC
Related Intelligence

Continue Reading

Cluttered developer's workstation with laptop code surrounded by notes.

Next.js Patches Code Execution Flaws in Caching, SVG Processing

Critical security flaws in Next.js have been patched in an out-of-band update, fixing two remote-code-execution bugs and one denial-of-service vulnerability that left applications open to attacks. The severe flaws, rated 9.5 on the CVSS scale, affected React Server Components and SVG processing.

Analyst 207
Server equipment rack in a neutral network operations setting.

NGINX Disrupts Multiple Flaws, Including Possible RCE and TLS Session Forgery

NGINX just dropped a critical update to squash five vulnerabilities, including a long-standing flaw dating back to May 2005 that could lead to code execution or crashes in certain configurations. The patches fix memory bugs, a TLS session-ticket weakness, and an HTTP/3 parser issue that could put your system at risk.

Analyst 207
Bank technology center with rows of workstations and employees surrounded by screens and financial data displays.

Bank of America Bolsters Tech Staff to Address AI-Discovered Vulnerabilities

Bank of America is ramping up its tech squad by hiring 1,000 contractors to tackle a surge in security work sparked by AI-discovered vulnerabilities. The move comes as the bank faces a hefty remediation bill of over a couple of hundred million dollars to address the issues flagged by Anthropic's Mythos model.

Analyst 207
Security engineer surrounded by computer equipment and screens displaying code and vulnerability reports in a bright lab…

AI Pentesting Matches Human Skill in Vulnerability Detection

Meet Daniel Thatcher, a seasoned security research engineer with 12 years of pentesting experience, who's shaking up the game with Intruder's AI-powered pentester that's giving human skills a run for their money in vulnerability detection. He shares his insights on what works - and what doesn't - in the world of AI-driven pentesting.

Analyst 207