Hotpatch for Windows 11 — June and July Are Baseline Months. Here's the Full 2026 Schedule

Hotpatch for Windows 11 lets security updates install and take effect without a device restart — same security coverage as a standard cumulative update, just without the reboot. But it doesn't fire every month. The cycle runs quarterly: three months of hotpatch updates, then a baseline month where a full cumulative update lands and a restart is required. June 2026 is one of those baseline months. So is July.

The 2026 hotpatch calendar

Hotpatch follows a predictable quarterly rhythm. Here is the full 2026 schedule based on Microsoft's official release notes:

Source: Windows Autopatch — Hotpatch updates (Microsoft Learn)

What hotpatch actually is

Hotpatch updates contain the same security content as a standard monthly cumulative update (the B-release). The difference is delivery: hotpatch patches the in-memory code of running processes, so the security fix takes effect immediately — no reboot required to flush and reload. Package sizes are also significantly smaller than standard LCUs, which means faster download and less network impact across a large fleet.

On baseline months, a standard cumulative update installs normally and a restart is required. Baseline months establish the updated code on disk that the next three hotpatch months will patch in memory.

Prerequisites — all must be met

Arm64 devices — one extra step

Hotpatch works on Arm64 devices (Surface Pro X, Copilot+ PCs, etc.) but requires CHPE (Compiled Hybrid PE) to be disabled first. Set this via registry or the DisableCHPE CSP:

# Registry path to disable CHPE for hotpatch on Arm64
# Set HotPatchRestrictions = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]
"HotPatchRestrictions"=dword:00000001

# Or deploy via Intune OMA-URI:
# ./Vendor/MSFT/Policy/Config/WindowsUpdate/DisableCHPE
# Value: 1

Why a device might not be hotpatching

If your eligible devices are not receiving hotpatch updates when they should be, check these in order:

You can verify hotpatch is active on a device using Event Viewer:

# Check if AllowRebootlessUpdates is active in Event Viewer
# Applications and Services Logs > Microsoft > Windows > WindowsUpdateClient > Operational
# Look for events confirming hotpatch application without restart

# PowerShell: check VBS status
(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).VirtualizationBasedSecurityStatus
# 2 = Running (hotpatch eligible)
# 0 = Off (hotpatch will not apply)

Hotpatch quality update report

Track hotpatch compliance across your fleet in Intune:

Intune admin center → Reports → Windows Autopatch → Windows quality updates → Reports tab → Hotpatch quality updates

The report shows per-policy counts for: Up to date, Hotpatched, Not up to date, In progress, Not ready, and Paused. Data refreshes every 4 hours.

Official Microsoft sources

• Hotpatch updates — Windows Autopatch (Microsoft Learn)
• Hotpatch quality update report — Windows Autopatch (Microsoft Learn)
• Alerts and Remediations — Windows Autopatch (Microsoft Learn)