What unsupported software does to Cyber Essentials and ISO 27001 after Windows Server 2016 end of support — the rules each scheme applies, whether ESU keeps you compliant, how segregation and scoping really work, the evidence assessors ask for, and a 150-day plan to fix it before January 2027.
A five-step Windows Server 2016 upgrade assessment: build a real inventory, check hardware against Windows Server 2025, chase application certifications, audit Active Directory prerequisites and price every route — then score each server into go, fix, re-route or defer verdicts.
What Windows Server 2016 Extended Security Updates really cost year by year, why the free-in-Azure route ended in April 2026, and a workload-by-workload framework for choosing between paying for ESU, upgrading to Windows Server 2025 and rehosting in Azure.
Why one jump to Windows Server 2025 beats a two-step upgrade, how the in-place and clean-install routes compare, the CPU and licensing checks that catch teams out, what the project really costs, and a cutover-weekend runbook that lands before the January 2027 deadline.
What the 12 January 2027 deadline actually changes, why it is a board-level risk for UK businesses, how upgrading in place, migrating to Azure, buying Extended Security Updates and replacing workloads with SaaS compare on cost, and a five-month plan that finishes before the change freeze.
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Windows Server 2016 📖 ~4 min read • Source: Microsoft KB5078740 • MSRC update-guide entry Related CVEs: CVE-2026-23669 CVE-2026-23671 CVE-2026-23672 CVE-2026-23673 CVE-2026-24285 CVE-2026-24289 CVE-2026-24291 CVE-2026-24294 +12 more Affected components: Windows Server 2016 Microsoft summary: Use after free in RPC Runtime allows an […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Windows Server 2022 📖 ~4 min read • Source: Microsoft KB5073700 • MSRC update-guide entry Related CVEs: CVE-2026-0386 CVE-2026-20816 CVE-2026-20820 CVE-2026-20821 CVE-2026-20828 CVE-2026-20831 CVE-2026-20833 CVE-2026-20834 +12 more Affected components: Windows Server 2022 Microsoft summary: Improper access control in Windows Deployment Services allows […]
🔴 Critical ⏱ 15–90 min Last verified: 25 May 2026 Affected versions: Windows Server 2022 📖 ~4 min read • Source: Microsoft KB5087537 • MSRC update-guide entry Related CVEs: CVE-2026-35421 CVE-2026-41089 CVE-2026-32161 CVE-2026-40403 CVE-2026-21530 CVE-2026-33834 CVE-2026-34329 CVE-2026-34330 +12 more Affected components: Windows Server 2022 Windows Server 2022, 23H2 Edition (Server Core installation) Microsoft summary: […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Windows Server 2025 📖 ~4 min read • Source: Microsoft KB5079473 • MSRC update-guide entry Related CVEs: CVE-2026-23669 CVE-2026-23671 CVE-2026-23672 CVE-2026-23673 CVE-2026-24283 CVE-2026-24285 CVE-2026-24287 CVE-2026-24289 +12 more Affected components: Windows Server 2025 Microsoft summary: Use after free in RPC Runtime allows an […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Windows Server 2019 📖 ~4 min read • Source: Microsoft KB5075897 • MSRC update-guide entry Related CVEs: CVE-2026-21519 CVE-2026-21248 CVE-2026-21247 CVE-2026-21234 CVE-2026-21236 CVE-2026-21533 CVE-2026-21513 CVE-2026-21510 +12 more Affected components: Windows Server 2019 (Server Core installation) Microsoft summary: Access of resource using incompatible […]
