Windows 11 Hotpatching Explained: What It Is, How It Works, and the 2026 Reality

Every month, IT administrators face the same problem: a new Patch Tuesday security update is ready, but deploying it means devices need to restart. Users interrupt their work, long-running processes stop, kiosk machines go offline, and remote workers lose connectivity at inconvenient times. In a large organization, coordinating restarts across thousands of devices is a logistical challenge even before considering the productivity cost.

Windows 11 hotpatching is Microsoft’s solution to this problem — and in May 2026, it was enabled by default for all eligible Windows Autopatch devices.

The premise is straightforward: hotpatch updates apply security fixes directly to running processes in memory, without replacing any files on disk. Since no file replacement is needed, no restart is required. Security protection is updated immediately and work continues uninterrupted.

This guide explains exactly how hotpatching works technically, who can use it, the 2026 update calendar reality, what changed with ARM64 support in August 2026, and what IT administrators need to know about exceptions to the no-restart promise.

What Is Windows 11 Hotpatching?

Windows 11 hotpatching is a feature that allows quality security updates to be applied without requiring a system restart, making it a game-changer for maintaining system availability while keeping devices secure.

It is available for Windows 11 Enterprise version 24H2 and 25H2, managed through Microsoft Intune and Windows Autopatch.

The feature changes the fundamental update experience for eligible enterprise devices. Traditionally, updates requiring a restart can disrupt workflows and productivity, especially in environments where continuous uptime is critical. Hotpatching applies most updates seamlessly in the background, sparing end users from interruptions.

Hotpatch updates allow security patches to be applied without requiring a system reboot. With hotpatches, devices receive the same level of security as traditional updates, ensuring consistent protection.

How Hotpatching Works — The Technical Mechanism

Understanding why hotpatching eliminates restarts requires understanding why traditional Windows updates require them.

Why standard updates need a restart:

When Windows installs a traditional cumulative update, it replaces files on disk — the DLL files, executable files, and kernel components that contain the patched code. Windows cannot replace files that are currently in use by running processes. A restart is required to flush the in-memory code, load the replacement files from disk, and resume with the patched versions active.

How hotpatch works differently:

Hotpatch patches the in-memory code of running processes directly, so the security fix takes effect immediately — no reboot required to flush and reload.

Instead of replacing files on disk, the hotpatch package identifies the specific memory regions of running processes that contain the vulnerable code and patches them directly. The vulnerable functions or code paths are replaced with patched versions in the active process memory — while the process continues running.

From the user’s perspective: nothing visibly changes. The app or service continues without interruption. But the security vulnerability has been addressed in the live running code. The update is complete, effective, and the device is protected.

Package size advantage:

Package sizes are also significantly smaller than standard LCUs (Latest Cumulative Updates), which means faster download and less network impact across a large fleet.

A full cumulative update packages the complete patched state of hundreds of Windows components — even components not affected by the current month’s vulnerabilities. A hotpatch package contains only the in-memory patches for the specific components that have vulnerabilities this month. The size reduction is significant, particularly for organizations managing large device fleets over bandwidth-constrained networks.

Baseline Months vs Hotpatch Months — The Quarterly Cycle

Hotpatching does not eliminate restarts entirely — it reduces them. Understanding the quarterly cycle is essential for accurate planning.

The four baseline months:

Four times per year, Windows 11 receives a “baseline” update — a full cumulative update that replaces files on disk in the traditional manner. These months require a device restart.

Baseline months establish the updated code on disk that the next three hotpatch months will patch in memory.

This is necessary because hotpatch modifies in-memory code based on the underlying disk files. If the disk files drift too far from what hotpatch expects, in-memory patching becomes unreliable. The quarterly baseline ensures the disk-based code is refreshed to a known good state that the next three months of hotpatches can work against.

The eight hotpatch months:

For the remaining eight months of the year, security updates arrive as hotpatches — in-memory patches that apply without a restart. These months deliver the same security content as traditional updates but without the restart requirement.

Devices receiving the hotpatch update will see a different KB number tracking the hotpatch release and a different OS version number than devices that received the standard monthly update for that month.

The 2026 Calendar — Five Restarts, Not Four

Marketing language around hotpatching often states “only four restarts per year.” The 2026 calendar reality is more nuanced — and important for administrators to understand before setting expectations.

Windows 11 hotpatching can remove up to eight planned monthly security-update restarts a year for eligible business PCs, but Microsoft’s own 2026 servicing calendar already shows why administrators should not translate that into “four reboots annually.”

What happened in 2026:

June 2026 was supposed to be a hotpatch month. Instead, Microsoft’s release-health calendar recorded it as a restart-required baseline. The June 2026 Patch Tuesday KB5094126 — which delivered Shared Audio, Low Latency CPU Profile, and the OLE Automation fix — required a baseline update rather than a hotpatch for hotpatch-enrolled devices.

July 2026 was the scheduled quarterly baseline — the KB5101650 record-breaking update fixing 570 vulnerabilities. This was an expected restart month.

The result: two restart-required months in a row (June and July), bringing the 2026 baseline count to five planned restarts instead of four.

August 2026:

Hotpatch resumed normally with the August 11, 2026 release — KB5120994. This was a standard hotpatch month with no restart required for enrolled devices.

September and October 2026:

Microsoft’s Message Center advisory MC1462918 announced that September 2026 would also require a restart. Microsoft confirms Windows hotpatch devices must restart for September and October 2026 updates, with regular hotpatching resuming in November.

The reason: the September security release arrives as a standard update for hotpatch-enabled devices because it changes security-related components that cannot be updated in memory.

The measured 2026 promise:

The measured promise for 2026 is seven avoided routine monthly security restarts, with five remaining baseline restarts, assuming the published calendar holds and devices remain eligible. That is a meaningful reduction — just not an end to the maintenance window.

Important clarification: The September and October restart requirement does not affect Autopatch enrollment. Microsoft confirms: affected devices remain enrolled after restarting — administrators do not need to reconfigure the policy or re-enroll endpoints to resume hotpatching in November.

ARM64 Hotpatching — August 2026 Expansion

Through mid-2026, hotpatching was limited to x64 (AMD and Intel) devices. In August 2026, Microsoft expanded hotpatch availability.

Microsoft’s August 2026 Windows 11 hotpatch release made hotpatching generally available for eligible Windows 11 versions 24H2 and 25H2 ARM64 devices.

This matters specifically for organizations using ARM64 hardware — Surface Pro X, Qualcomm Snapdragon X laptops, and Copilot+ PCs using ARM processors.

The CHPE requirement:

ARM64 hotpatching has one additional setup step that x64 does not require. Hotpatch works on ARM64 devices, but requires CHPE (Compiled Hybrid PE) to be disabled because Microsoft says the compatibility layer is incompatible with hotpatch updates. Disabling CHPE requires a one-time restart before the device is ready for hotpatching.

CHPE is a compatibility layer that allows 32-bit x86 code to run on ARM64 processors. Disabling it means any application that relies on 32-bit x86 code on an ARM64 device may not function correctly. Organizations should inventory their ARM64 devices for 32-bit application dependencies before disabling CHPE.

32-bit Microsoft 365 Apps on ARM:

A connected deadline: security updates for 32-bit Microsoft 365 Apps on ARM devices end in December 2026. Organizations with ARM devices running the 32-bit version of Office applications should plan migration to 64-bit ARM-native builds before that deadline.

Hotpatching vs Standard Updates — Side by Side

	Standard Monthly Update	Hotpatch Update
How it applies	Replaces files on disk	Patches code in running processes
Restart required	Always	No
Security content	Full monthly CVEs	Same security content
Package size	Large (full cumulative)	Significantly smaller
Takes effect	After restart	Immediately
When it applies	Every month	8 months/year (baseline: 4 months)
KB number	Standard KB	Different hotpatch KB
OS build	Standard build	Slightly different build number
Available editions	All Windows editions	Windows 11 Enterprise only

What Devices Qualify for Hotpatching?

Hotpatching has specific eligibility requirements. Not every Windows 11 Enterprise device can use it.

Required:

Windows 11 Enterprise version 24H2 or 25H2 — as part of the Windows 11 25H2 feature set, hotpatching is a core enterprise capability.

x64 processor (AMD or Intel) — for standard hotpatch enrollment. ARM64 devices are now also supported but require CHPE disabled.

Microsoft Intune management — hotpatch is delivered through Intune policies, not through standard Windows Update channels.

Virtualization Based Security (VBS) enabled — VBS is a Windows security feature that uses hypervisor capabilities to protect sensitive processes. Hotpatch relies on VBS infrastructure to safely modify in-memory code. If VBS is not enabled, hotpatch cannot function.

Eligible license — Windows Enterprise E3 or E5, Microsoft 365 Business Premium (after April 2025 licensing expansion), or Windows Education A3 or A5.

Windows Autopatch enrollment OR hotpatch-enabled Intune policy:

All eligible Windows 11 Enterprise, version 24H2 devices managed by a hotpatch-enabled quality update policy will be offered hotpatch updates in a quarterly cycle.

You do not need full Windows Autopatch enrollment to use hotpatching — a standalone hotpatch-enabled quality update policy in Intune is sufficient.

Not eligible:

Windows 11 Home and Pro — hotpatching is exclusive to Enterprise editions. Home and Pro users continue to receive standard monthly updates with restart requirements.

Windows 10 devices — hotpatching is not available for Windows 10.

Devices not managed by Intune — WSUS-managed or Group Policy-managed devices cannot receive hotpatch updates.

How to Enable Hotpatching in Intune

Administrators can create a hotpatch-enabled quality update policy in the Microsoft Intune portal.

Go to the Microsoft Intune admin center at intune.microsoft.com. Navigate to Devices, Windows, Update rings for Windows 10 and later. Create a new policy or edit an existing one. Enable the hotpatch option under the Windows Update settings.

Eligible devices enrolled in this policy receive hotpatch updates during hotpatch months and standard baseline updates during baseline months automatically — no monthly manual approval required.

Since May 2026, hotpatch was enabled by default for all eligible devices enrolled in Windows Autopatch. Organizations using Autopatch do not need to manually configure hotpatch — it is active automatically for enrolled eligible devices.

The “One Restart Per Month” Initiative — Different From Hotpatch

A separate Microsoft initiative announced in mid-2026 is worth distinguishing from hotpatching, as they are sometimes confused.

Beginning with updates released on or after July 28, 2026, Microsoft started rolling out an update experience that groups several restart-requiring Windows updates together rather than letting them trigger separate restarts throughout the month. Under Microsoft’s “one restart a month” Windows Update approach, driver, .NET, firmware, and monthly security updates can be coordinated to share a single scheduled restart.

The distinction between Microsoft’s two approaches is important: the one-restart initiative applies to all Windows devices and reduces the number of restarts, but does not eliminate them. Hotpatching reduces restarts in eight of twelve months for eligible Enterprise devices by patching in memory. These are complementary, not competing approaches.

For an organization’s Home and Pro devices — which cannot use hotpatch — the one-restart-per-month initiative provides meaningful improvement. For Enterprise devices enrolled in hotpatch, both benefits apply: hotpatch for most months and coordinated single restarts in the baseline months that do require them.

The Real-World Impact for IT Administrators

What hotpatching actually delivers in 2026:

For a typical Windows 11 Enterprise fleet enrolled in hotpatch in 2026, the practical restart calendar looks like this: five baseline/restart months (January, April, June, July, September — or similar based on Microsoft’s published calendar) and seven hotpatch months where security updates apply without any restart.

That is seven months per year where IT does not need to schedule maintenance windows, coordinate with users about restart timing, or chase devices that have not applied an update because users dismissed the restart prompt. For organizations with thousands of devices, the operational hours saved are substantial.

Where hotpatch exceptions occur:

Emergency and out-of-band updates can still require restarts — these are security responses to critical vulnerabilities that cannot wait for a hotpatch window. In March 2026, Microsoft used an out-of-band hotpatch to address critical Windows 11 RRAS vulnerabilities without requiring affected systems to restart — a notable example of the technology being used for emergency patches too. However, this is not guaranteed for all emergency patches.

Firmware and driver updates — which hotpatch cannot address through in-memory patching — continue to require restarts when they occur.

Feature upgrades — such as the annual Windows 11 version update — are not hotpatches and require the standard update process.

Hotpatching is particularly valuable for: Devices where users run long-duration workloads that are disruptive to interrupt — rendering, data processing, video calls. Kiosk machines where unplanned restarts cause operational disruption. Remote workers where restart coordination across time zones is difficult. Environments where compliance timelines require security patches to be effective as quickly as possible after release.

Frequently Asked Questions