Microsoft’s WSUS Patch Causes Hotpatching Failures on Windows Server 2025

Microsoft has acknowledged a critical issue affecting Windows Server 2025 systems enrolled in the Hotpatch programme, after a WSUS patch was inadvertently distributed to machines configured for Hotpatch updates. The distribution error briefly made the update available to all Windows Server 2025 machines, with a limited number of Hotpatch-enrolled devices already downloading and installing it, and Microsoft has since restricted the update’s availability to those not enrolled in the Hotpatch programme.

The incident affects only Hotpatch-enrolled Windows Server 2025 devices and virtual machines, with those that installed the incorrect update facing a temporary interruption to their Hotpatch cycle; affected machines will be removed from the Hotpatch train and will not receive November and December 2025 updates.

According to Microsoft, impacted systems will be re-enrolled after installing the planned baseline update scheduled for January 2026, with the next Hotpatch update offered in February 2026, representing a three-month gap in Hotpatch functionality.

A workaround for devices that downloaded but have not yet installed the problematic update involves pausing updates in Settings, then un-pausing and scanning for updates to receive the correct package, while Hotpatch-enrolled machines that avoided installing the incorrect update should install Security Update KB5070893 on top of the October 2025 baseline update KB5066835 to stay on the Hotpatch cycle.