All five critical bugs are use-after-free flaws, in ServiceWorker, CSS, Layout, Skia and Accessibility; Extended Stable moves to 156.0.8078.100 the same day.
Windows Server 2016 and 10 LTSC 2021 lose support on 13 January 2027
EditorialBy TrustList Editorial
Microsoft's lifecycle pages list three paid ESU years running to 8 January 2030 for both products, and say containers released with Windows Server 2016 follow the same dates.
- United States of America
- Patch Management
- Cybersecurity
- Vulnerability Management
About Windows Server 2016 and 10 LTSC 2021 lose support on 13 January 2027
Windows Server 2016 and 10 LTSC 2021 lose support on 13 January 2027
11 November 2026: Microsoft's lifecycle pages show that Windows Server 2016 leaves extended support, and Windows 10 Enterprise LTSC 2021 leaves mainstream support, on 13 January 2027. Both pages then list three Extended Security Update years, the first starting the same day, so organisations that cannot move in time have a dated route to keep receiving security fixes.
Not yet independently verified. Microsoft's lifecycle pages say nothing about ESU pricing or how it is bought, and we did not open the message centre reminders. The Windows 10 Enterprise LTSC 2021 page lists a mainstream end date and no extended end date, so we do not state one. We will update this when it can be confirmed, and remove this note.
Two products, two different labels
The wording on the two pages differs, and it matters for planning. Windows Server 2016, covering the Datacenter, Essentials, MultiPoint Premium and Standard editions, follows Microsoft's Fixed Lifecycle Policy and has three dates: it started on 15 October 2016, mainstream support ended on 12 January 2022, and extended support ends on 13 January 2027.
Windows 10 Enterprise LTSC 2021 also follows the Fixed Lifecycle Policy, but its page lists only a start date, 16 November 2021, and a mainstream end date of 13 January 2027. It carries no extended end date column at all: mainstream support ends that day, and the ESU years follow.
The three ESU years
Both pages carry the same release rows for Extended Security Updates, and the dates are the following:
- ESU Year 1: 13 January 2027 to 11 January 2028
- ESU Year 2: 12 January 2028 to 9 January 2029
- ESU Year 3: 10 January 2029 to 8 January 2030
The pages show these as releases of the product, in the same table as the original release, which is listed as running from its start date to 13 January 2027. They do not say what ESU costs, who can buy it or how it is activated, so that has to be settled with Microsoft or a licensing partner.
Containers and the Pacific time zone
The Windows Server 2016 page carries a note that containers released with Windows Server 2016 follow the same lifecycle dates. Teams that run container base images on that release should therefore plan the move together with the hosts rather than treat images as a separate track. The page also links to Microsoft's guidance on Windows Server end of support and Microsoft 365 Apps, which is worth a look for anyone who runs Office applications on a server that is about to age out.
Microsoft shows its support dates in Pacific Time, with Redmond, Washington as the reference, so teams in other time zones should read the end date in that frame.
How long these systems have run
Windows Server 2016 reaches its end a little over ten years after release. LTSC 2021 reaches its mainstream end about five years and two months after its 16 November 2021 start. After 13 January 2027, a machine that is neither moved nor enrolled in ESU stops receiving the monthly security updates, and any flaw found afterwards stays open.
Sources
- Microsoft Learn: Windows Server 2016 lifecycle, 11 November 2026
- Microsoft Learn: Windows 10 Enterprise LTSC 2021 lifecycle, 11 November 2026
Categories & features
- United States of America
- Patch Management
- Cybersecurity
- Vulnerability Management
TrustList Weekly
The week in software and IT, in one email
The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.
You may be interested in
An administrator with network access to Panorama can run code as root; firewalls, Cloud NGFW and Prisma Access are not affected, and the November release adds seven lower-rated advisories.
CVE-2026-119618 affects every release from 2.4.55 to 2.4.70 with HTTP/2 enabled, and the standalone mod_h2 module up to 2.0.42; two lesser flaws in mod_md and mod_vhost_alias are fixed too.
Cisco's advisory for CVE-2026-20320 still says it knows of no malicious use, while CISA's catalogue now says otherwise. An old Openwave transcoder flaw was added the same day.
CVE-2026-124194 lets a crafted file make Outlook connect out without its usual warning, leaking credentials. CISA has given US agencies until 24 November to patch it.
Releases 3.19.14, 3.20.10, 3.21.8 and 3.22.3 fix a use-after-free that lets an SSH user run commands as the Git service, and an incomplete earlier fix that let Dependabot write Actions workflows.
CVE-2026-76506 (CVSS 7.6) lets any user with valid credentials run commands, write files and read data through the web interface. Release 2.1(2c) fixes it; 2.0 and earlier must migrate, and there is no workaround.
Bulletins 2026-161 to 164 cover AWS SDK for pandas, the Serverless MCP Server, Virtual Engineering Workbench and the aidlc-traceability CLI. Two fixes shipped months ago; two need an update or redeploy now.
More on TrustList
Everything here links back to the same verified catalogue. Pick your next stop.
- More United States of AmericaThe ranking for this subject
- CompaniesAgencies, consultancies and IT service providers, ranked by verified reviews.
- ProductsSoftware and SaaS with pricing, features, integrations and alternatives.
- AwardsAnnual recognition decided by verified reviews and an independent jury.
- LaunchesNew products and releases, voted up by the community every day.
- AI ModelsBenchmark scores and community ratings for every major model.
- RequestsBuyers describe what they need; vendors respond directly.
- PeopleReviewers, authors and makers with public profiles.
- ComparePut up to four listings side by side before you shortlist.