Advisories
Windows Server 2022 Slips Into Extended Support Next Month—Plan Your Upgrade to 2025 Before 2031
Microsoft announced that Windows Server 2022 will exit mainstream support on Oct 13 2026, sliding into a five‑year extended phase that ends Oct 14 2031. Hotpatching for the Datacenter: Azure Edition stays active until Oct 2027, while the free Windows 10 ESU program now runs until Oct 12 2027. Admins are urged to begin testing Windows Server 2025, which launched in 2024 and will stay mainstream until Nov 13 2029 with extended support until 2034. A free 180‑day trial is available via the Microsoft Evaluation Center. Early migration is key to keep your environment secure and compliant.
Microsoft’s latest reminder is a stark reminder of the ticking clock on Windows Server 2022. The operating system, released in September 2021 as the Long‑Term Servicing Channel (LTSC) version, will hit the end of mainstream support on Oct 13 2026. That means no new feature updates, but security patches will continue at no extra cost until Oct 14 2031.
Extended Support & Hotpatching Details
- Standard extended support delivers monthly security updates for the next five years.
- Datacenter: Azure Edition receives an extra year of hotpatching, extending to Oct 2027.
- The free Windows 10 Extended Security Updates (ESU) program has been quietly pushed back one year, keeping consumer devices secure until Oct 12 2027.
Why Upgrade Now?
Microsoft is urging administrators to start the migration process before the 2031 cutoff. The newest LTSC release, Windows Server 2025, entered the Insiders program in January 2024 and became generally available in November 2024. It will enjoy mainstream support until Nov 13 2029 and extended support until Nov 14 2034.
To smooth the transition, Microsoft recommends:
- Evaluate upgrade paths early.
- Deploy the 180‑day Windows Server 2025 trial from the Microsoft Evaluation Center.
- Use the Lifecycle Policy search tool to track all product end‑of‑life dates.
“Windows Server 2025 is now the latest LTSC release for Windows Server. To keep your environment protected and supported, plan to upgrade to Windows Server 2025 for full mainstream support.” – Microsoft
Failing to act could leave your infrastructure exposed to unpatched vulnerabilities and regulatory gaps. Make the move before the extended support window closes, and keep your servers future‑proof.
Related vulnerabilities
tvOS 27.0 RC 24J360: Apple Unveils Next‑Gen TVOS Preview
Apple’s latest tvOS 27.0 release candidate, rolled out on September 9 2026, offers developers a glimpse of the next generation of Apple TV software. The RC brings new MediaKit APIs, performance optimizations, enhanced remote‑control handling, and tighter sandboxing for third‑party apps. It also expands accessibility support and fixes several critical bugs. The update is now available for download on the Apple Developer portal, giving early adopters a chance to test and provide feedback before the final release.
Read briefing
Cisco FMC Java Deserialization Flaw Lets Remote Attacker Gain Root
Cisco’s Secure Firewall Management Center (FMC) suffers a critical insecure Java deserialization bug that permits unauthenticated remote actors to execute arbitrary code as root. By sending a crafted Java byte stream to a specific TCP port from a host listed in the external database access list, an attacker can elevate privileges and run any command. No workaround exists; Cisco has released patches for the affected releases. The flaw is catalogued as CVE‑2026‑20242 and rated Critical.
Read briefing
Cisco ASA/FTD DTLS DoS Vulnerability (CVE‑2026‑20250) – Immediate Patch Required
Cisco’s Adaptive Security Appliance (ASA) and Threat Defense (FTD) software for the 3100 and 4200 series can be forced into a denial‑of‑service state by an unauthenticated attacker sending crafted DTLS traffic. The flaw stems from improper resource handling during DTLS message processing, causing a device reload. Cisco has issued patches and workarounds; applying the update is essential to keep firewalls online.
Read briefing
Cisco ISE Web Interface Vulnerability Allows Remote XSS Attack (CVE‑2026‑20309)
A newly disclosed flaw in Cisco Identity Services Engine’s web‑based management console lets attackers inject malicious scripts into a victim’s browser. The vulnerability stems from inadequate input validation, enabling reflected XSS that can run arbitrary code or steal browser data. Cisco has released patches; no workarounds exist.
Read briefing