The Update BureauHotpatch installs the monthly Windows security update without a restart. It patches the code of running programs in memory, so the PC or server keeps working while it is protected. It is available for Windows 11 Enterprise (version 24H2 and later) and Windows Server 2025, and for Windows Server 2022 Datacenter: Azure Edition. It is not available on Windows 11 26H1.
The yearly cycle
Every quarter has one baseline month, an ordinary cumulative update that needs a restart, followed by two hotpatch months:
| Quarter | Baseline (restart) | Hotpatch (no restart) |
|---|---|---|
| 1 | January | February, March |
| 2 | April | May, June |
| 3 | July | August, September |
| 4 | October | November, December |
That is 4 baselines and 8 hotpatches a year. Sometimes a hotpatch month becomes an unplanned baseline: when an important fix, such as a zero-day, cannot be released as a hotpatch, that month needs a restart. In 2026, June and September were restart baselines on Windows 11 25H2. The regular schedule does not shift: if June becomes a baseline, July is still one. The calendar shows what to expect.
Why the KB and build are different
A hotpatch contains security fixes only, so it is a different package with its own KB article. On August 11, 2026, the standard update for Windows 11 25H2 was KB5121003 (build 26200.9168), while the hotpatch was KB5120994 (build 26200.9106). A hotpatch is not "behind" the standard update: it is another track. Look for Hotpatch in the title in Settings › Windows Update › Update history, and paste that list into the update history tool to see each update explained. Non-security content and .NET updates are not part of a hotpatch.
Requirements
Windows 11 Enterprise, managed with Windows Autopatch:
- A licence such as Windows 11 Enterprise E3 or E5, Microsoft 365 F3, Education A3 or A5, Microsoft 365 Business Premium, or Windows 365 Enterprise.
- Windows 11, version 24H2 or later, on the latest baseline.
- Virtualization-based security (VBS) turned on. Check System Information for Virtualization-based security.
- An Intune Windows quality update policy with When available, apply without restarting the device ("Hotpatch") set to Allow.
- On Arm64 PCs, the CHPE binaries must be disabled.
A device that does not qualify simply receives the standard cumulative update, with a restart. If you upgrade a device to a new Windows version in a hotpatch month, it switches to standard updates until the next baseline.
Windows Server 2025 (Standard or Datacenter) gets hotpatches when connected to Azure Arc, at no extra cost, and is managed with Azure Update Manager. Azure Edition virtual machines on Azure and Azure Local also support it.
Rolling back
There is no automatic rollback. To remove a hotpatch, uninstall it, install the last baseline and restart.
Sources
Edited by the site editor. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake