CVE-2026-97631, rated CVSS 9.5, sits in the open-source UEFI network stack that most PC and server firmware builds on. The advisory lists no patched release yet, only a pending pull request.
Windows Server 2016 gets its last security update in January 2027
EditorialBy TrustList Editorial
Essentials-specific features such as Remote Web Access lose support the same day, ESU covers only Standard and Datacenter, and Server 2022 moved to extended support on 13 October.
- United States
- Cybersecurity
- Patch Management
- Data Center
About Windows Server 2016 gets its last security update in January 2027
Windows Server 2016 gets its last security update in January 2027
14 October 2026: Microsoft has told administrators that Windows Server 2016 reaches end of updates on 12 January 2027, and that the January 2027 security update will be the last one. From then on, servers still running it receive no monthly fixes for newly found flaws. The notice is a 90-day reminder posted to the Microsoft 365 Message Center, tagged as having admin impact.
Not yet independently verified. The Message Center posts were read through the mc.merill.net archive, not tenant admin centre. No ESU price or term is stated in the sources. We will update this when it can be confirmed, and remove this note.
Which editions the date covers
The date applies to every edition of Windows Server 2016: Datacenter, Essentials, MultiPoint Premium and Standard. Microsoft's lifecycle page lists the same extended end date, and shows that mainstream support for the release ended in January 2022. The 2016 release has therefore been in extended support, security fixes only, for almost five years.
Windows Server 2016 Essentials carries an extra warning. Microsoft says support for its Essentials-specific features, including Remote Web Access, ends on the same date, and that any Essentials capability that keeps working afterwards should be treated as unsupported. Containers released with Windows Server 2016 follow the same lifecycle dates, according to the lifecycle page.
What Microsoft offers instead
The vendor's recommended route is an upgrade to Windows Server 2025, the latest Long-Term Servicing Channel release. A free 180-day evaluation is available from the Microsoft Evaluation Center for teams that want to test their workloads first.
Extended Security Updates are available for Windows Server 2016 Standard and Datacenter editions for organisations that need more time. The message does not give a price or a term for the ESU programme, and it names no ESU option for Essentials or MultiPoint Premium, so anyone running those editions should ask their Microsoft reseller before assuming cover.
The Windows Server 2022 milestone passed this week
A second message, posted the same day, records that Windows Server 2022 reached the end of mainstream support on 13 October 2026. The October 2026 security update was the last mainstream update for that version. Nothing is lost on the security side: extended support includes security updates at no additional cost, and monthly updates continue through 14 October 2031.
Microsoft also says hotpatch support for Windows Server 2022 Datacenter: Azure Edition has been extended through October 2027. Servers enrolled in hotpatching keep receiving monthly security updates without a restart until then.
The date to plan around
For Windows Server 2016 the working deadline is the January 2027 update cycle, about three months after the reminder. Microsoft points administrators to its Windows Server release information, the Lifecycle FAQ for Windows Server and the Microsoft Lifecycle Policy search tool for the full dates, and to the Fixed Lifecycle Policy for the 2022 terms.
Teams with 2016 servers that cannot move before then have two choices on the record: buy ESU for Standard or Datacenter, or run the machines unpatched and unsupported. Microsoft's own wording for the second case is that devices will no longer receive protections from the latest security threats.
Update, 22 October 2026: Microsoft's own lifecycle page for Windows Server 2016 gives the end of extended support as 1/13/2027 6:59:59 AM; mainstream support ended in January 2022. It states no Extended Security Update price.
Sources
- Microsoft 365 Message Center: MC1507705, 90-Day Reminder: Windows Server 2016 will reach end of updates on January 12, 2027, 14 October 2026
- Microsoft 365 Message Center: MC1507704, Windows Server 2022 has reached end of mainstream support, 14 October 2026
- Microsoft Learn: Windows Server 2016 lifecycle (read 2026-10-15), 15 October 2026
- Microsoft Learn: Windows Server 2022 lifecycle (read 2026-10-15), 15 October 2026
- Microsoft Learn: Windows Server 2016 lifecycle - read 22 October 2026
Categories & features
- United States
- Cybersecurity
- Patch Management
- Data Center
TrustList Weekly
The week in software and IT, in one email
The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.
You may be interested in
HPE published CVE-2026-76719 (rated 8.2) and CVE-2026-76720 (4.3) on 29 September 2026: a cross-site scripting flaw that can lead to session hijacking and an open redirect in HPE OneView before 11.40. Update the appliance to 11.40.
The Linux kernel ESP page-cache flaw CVE-2026-46300, which CISA says can be chained to plant PHP webshells as root, is due by 31 October; VMware ESX CVE-2026-41709, which lets an administrator act unlogged, by 11 November.
Palo Alto-based PaleBlueDot AI, which runs its own GPU clusters, a GPU marketplace and serverless inference, announced a $200 million Series C led by ComputeCore at a stated $3.2 billion valuation on 1 October 2026.
Maryland Governor Wes Moore’s executive order of 23 September 2026 has a state task force review every data centre of 25 MW or more that seeks a permit, incentive or letter of support, and rate it Aligned, Conditionally Aligned or Not Aligned.
A White Paper would replace 140-year-old law with offences carrying up to 14 years in prison, statutory resilience duties for cable providers and a regime for sensing technology on fibre. Consultation runs 12 weeks.
Penso serves about 1,600 corporate and public-sector clients from São Paulo with five Brazilian data centres; it says brand, team and service channels stay the same.
Researchers found about 2,100 internet-exposed GPU servers in scans between March and May. Nvidia rates the bug 8.2 and shipped the fix in September; no attacks are reported.
More on TrustList
Everything here links back to the same verified catalogue. Pick your next stop.
- More United StatesThe ranking for this subject
- CompaniesAgencies, consultancies and IT service providers, ranked by verified reviews.
- ProductsSoftware and SaaS with pricing, features, integrations and alternatives.
- AwardsAnnual recognition decided by verified reviews and an independent jury.
- LaunchesNew products and releases, voted up by the community every day.
- AI ModelsBenchmark scores and community ratings for every major model.
- RequestsBuyers describe what they need; vendors respond directly.
- PeopleReviewers, authors and makers with public profiles.
- ComparePut up to four listings side by side before you shortlist.