Windows Server End of Life: 1,939 Flaws in 2012 and 2012 R2 Were Fixed Only for ESU Buyers. 2016 Is Next

Windows Server end of life hits two milestones on October 13, 2026: Windows Server 2012 and 2012 R2 get their final Extended Security Update, and Windows Server 2022 leaves mainstream support. Since 2012 extended support ended in October 2023, Microsoft has listed 1,939 vulnerabilities in 2012 or 2012 R2, patched only for ESU buyers. Windows Server 2016 ends Jan 12, 2027.

Every Windows Server end of life date on one timeline

Each bar runs from general availability to the last date Microsoft ships security updates for that version under any program. Dates come from Microsoft’s Lifecycle pages, converted from the UTC timestamps in the page source to Pacific time, which is how Microsoft defines them.

The Windows Server 2016 ESU bar is dashed: Microsoft says ESUs will cover “up to three years, through 2030”; it is drawn to January 12, 2030, the date endoflife.date lists. The 2008 and 2008 R2 Premium Assurance phase comes from Microsoft’s support notes for the final monthly rollups.

Windows Server lifecycle table

Long-Term Servicing Channel versions only. Every mainstream and extended date matches the endoflife.date API. The endoflife.date entries omit the Azure-only fourth ESU year and Premium Assurance for 2008 and 2008 R2, which this table includes.

Does an out-of-support Windows Server keep getting vulnerabilities?

Yes. To test it, we downloaded every monthly Microsoft security release from January 2021 to Sep 2026 through the MSRC CVRF API and counted, for each Windows Server version, the CVEs Microsoft lists as affecting it. The counts do not fall away when support ends. They stay in the hundreds per year until Microsoft stops listing the version at all.

Unique CVEs listed per version and year. Color shows the support phase for most of that year. *2026 is January to Sep. Counts in grey cells before a version’s release come from older CVEs whose product lists Microsoft later updated.

Windows Server 2008 and 2008 R2 are the clearest case. Paid ESUs ended in January 2023 and the Azure-only fourth year ended on Jan 9, 2024. Microsoft kept fixing them after that, but only for customers with Premium Assurance, a separate contract. From February 2024 to January 2026 it listed 704 new CVEs affecting 2008 or 2008 R2, 41 rated Critical and 23 marked exploited. A server without that contract got no fix for any of them.

Then the 2008 R2 bars stop. Since Feb 2026, Microsoft has listed 962 CVEs for Windows Server 2012 R2 and none for 2008 R2. That does not mean 2008 R2 became safe. It means Microsoft no longer assesses it. In 2025, 81% of the CVEs listed for 2012 R2 were also listed for 2008 R2, so most of the newer flaws plausibly reach the older code too, with no public record either way.

Windows Server 2012 and 2012 R2: the last ESU patch is October 13, 2026

Microsoft’s Azure Arc documentation is explicit: the October 13, 2026 security update is the final update provided through ESUs, and Arc-enabled ESU licenses for 2012 deactivate at midnight UTC on October 14, 2026. During the three ESU years (November 2023 to Sep 2026 in our data), Microsoft listed 1,939 CVEs affecting 2012 or 2012 R2: 154 rated Critical and 40 marked as exploited in the wild. Any 2012 machine that was not enrolled has gone without those fixes since 2023.

The flow has sped up, not slowed. Windows Server 2012 R2 picked up 999 CVEs from January to Sep 2026, against 481 in all of 2025. That matches the jump in total Microsoft fixes this year shown in our Patch Tuesday statistics for 2026, and the wider rise in published vulnerabilities tracked in our CVE statistics for 2026. Exploited CVEs affecting 2012 or 2012 R2 so far in 2026:

• CVE-2026-20805 Desktop Window Manager Information Disclosure Vulnerability Jan 2026
• CVE-2026-21510 Windows Shell Security Feature Bypass Vulnerability Feb 2026
• CVE-2026-21513 MSHTML Framework Security Feature Bypass Vulnerability Feb 2026
• CVE-2026-21525 Windows Remote Access Connection Manager Denial of Service Vulnerability Feb 2026
• CVE-2026-21533 Windows Remote Desktop Services Elevation of Privilege Vulnerability Feb 2026
• CVE-2026-32202 Windows Shell Spoofing Vulnerability Apr 2026
• CVE-2026-56155 Active Directory Federation Services Elevation of Privilege Vulnerability Jul 2026
• CVE-2026-68820 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Aug 2026
• CVE-2026-85880 Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability Sep 2026

Several sit in components common on MSP-managed servers: Remote Desktop Services, the Windows Shell, and Active Directory Federation Services. After October 13, the next flaws of this kind will not be fixed for 2012 at all.

Windows Server 2016: 91 days left

Windows Server 2016 is the next big cliff. Extended support ends on Jan 12, 2027. Microsoft listed 1,283 CVEs affecting it from January to Sep 2026, up from 492 in the same months of 2025; 114 were Critical and 10 were exploited. 78% of this year’s 2016 CVEs were also listed for 2012 R2, so the 2012 experience is a fair preview of what an unpaid 2016 server will face from February 2027.

Microsoft will sell Windows Server 2016 ESUs for up to three years. Through Azure Arc they could be configured from August 3, 2026, and billing begins January 13, 2027. They cover Standard and Datacenter editions and provide Critical and Important security updates only.

Windows Server 2022 leaves mainstream support

October 13, 2026 is also the last day of mainstream support for Windows Server 2022. This change is far less urgent than the others: under Microsoft’s Fixed Lifecycle Policy, extended support still includes security updates, and it runs to Oct 14, 2031. What ends is non-security updates and design or feature change requests. Windows Server 2022 had 1,583 CVEs listed from January to Sep 2026, and those fixes reach every customer, not only ESU buyers.

CVEs per Windows Server version per year

Each cell: unique CVEs listed as affecting the version, with Critical / exploited counts below. Critical is Microsoft’s severity for that version; exploited is Microsoft’s current “Exploited: Yes” flag. *2026 is January to Sep.

What it costs to keep an old server patched

Microsoft publishes the ESU price structure, not a simple per-server price. Here is what its own documents and price list say.

Per-core-hour rates are Microsoft’s USD list prices from the Azure Retail Prices API (Global region, effective 2026-08-01 for 2016). Monthly figures use 730 hours. At list price, 16 Standard cores of 2016 ESU come to about $1,000 a year, and 16 Datacenter cores to about $5,756. Partner and agreement pricing may differ.

Supported upgrade paths

Microsoft’s in-place upgrade matrix (installation media) decides how many hops an old server needs. Windows Server 2025 changed the rule: nonclustered servers can now jump up to four versions, while earlier releases allowed two. Cluster rolling upgrades still move one version at a time.

Windows Server 2012 R2 cannot upgrade in place to 2022, but it can go straight to 2025. Windows Server 2012 needs a hop through 2012 R2 or 2016. 2008 and 2008 R2 have no in-place path to a supported version in this matrix. Each upgrade requires a license for the target version.

SQL Server end of support dates

Many of these servers also run SQL Server, which has its own clock. From Microsoft’s Lifecycle pages:

SQL Server 2016 left extended support on Jul 14, 2026, so it now gets security fixes only through ESUs (Year 3 ends Jul 17, 2029). SQL Server 2017 extended support ends Oct 12, 2027.

What this means for MSPs

Frequently asked questions

Is Windows Server end of life?

Some versions are. Windows Server 2008 and 2008 R2 received their last update on Jan 13, 2026, and only for Premium Assurance customers. Windows Server 2012 and 2012 R2 get their final Extended Security Update on Oct 13, 2026. Windows Server 2016 leaves extended support on Jan 12, 2027. Windows Server 2019, 2022, and 2025 are supported.

When does Windows Server 2016 reach end of life?

Extended support for Windows Server 2016 ends on Jan 12, 2027, 91 days after October 13, 2026. Microsoft sells Extended Security Updates for up to three years after that. Microsoft listed 1,283 CVEs affecting Windows Server 2016 from January to Sep 2026.

Will Windows Server versions still be supported in 2027?

Windows Server 2019 (extended support to Jan 9, 2029), 2022 (to Oct 14, 2031), and 2025 (to Nov 14, 2034) are supported through 2027. Windows Server 2016 is supported only until Jan 12, 2027, then through paid ESUs.

Can you go from Server 2019 to 2025?

Yes. Microsoft supports an in-place upgrade from Windows Server 2019 to 2025. Starting with Windows Server 2025, nonclustered servers can upgrade up to four versions at once, so 2012 R2, 2016, 2019, and 2022 can all upgrade directly. Each upgrade needs a license for the new version.

What happens when Windows Server reaches end of support?

Vulnerabilities keep appearing, but fixes stop for anyone not paying. After Azure-only ESUs for Windows Server 2008 and 2008 R2 ended in January 2024, Microsoft still listed 704 new CVEs affecting them through January 2026, 23 of them exploited, with fixes only for Premium Assurance customers.

When does Windows Server 2022 mainstream support end?

Mainstream support for Windows Server 2022 ends on Oct 13, 2026. Security updates continue under extended support until Oct 14, 2031.

Methodology

References

1. Microsoft Lifecycle, Windows Server 2008. Accessed October 2026.
2. Microsoft Lifecycle, Windows Server 2008 R2. Accessed October 2026.
3. Microsoft Lifecycle, Windows Server 2012. Accessed October 2026.
4. Microsoft Lifecycle, Windows Server 2012 R2. Accessed October 2026.
5. Microsoft Lifecycle, Windows Server 2016. Accessed October 2026.
6. Microsoft Lifecycle, Windows Server 2019. Accessed October 2026.
7. Microsoft Lifecycle, Windows Server 2022. Accessed October 2026.
8. Microsoft Lifecycle, Windows Server 2025. Accessed October 2026.
9. Microsoft, Lifecycle FAQ: Extended Security Updates. Accessed October 2026.
10. Microsoft, Extended Security Updates for Windows Server overview. Accessed October 2026.
11. Microsoft, Prepare to deliver Extended Security Updates for Windows Server (Azure Arc). Accessed October 2026.
12. Microsoft, Deliver Extended Security Updates for Windows Server (Azure Arc). Accessed October 2026.
13. Microsoft Support, KB5073695 (Windows Server 2008 R2 Premium Assurance, January 13, 2026). Accessed October 2026.
14. Microsoft Support, KB5073697 (Windows Server 2008 Premium Assurance, January 13, 2026). Accessed October 2026.
15. Microsoft, Plan your Windows Server upgrade. Accessed October 2026.
16. Microsoft, Fixed Lifecycle Policy. Accessed October 2026.
17. Microsoft, Windows Server release information. Accessed October 2026.
18. MSRC CVRF API v3.0. Accessed October 2026.
19. Azure Retail Prices API and Azure Arc pricing. Accessed October 2026.
20. Microsoft Lifecycle, SQL Server 2012. Accessed October 2026.
21. Microsoft Lifecycle, SQL Server 2014. Accessed October 2026.
22. Microsoft Lifecycle, SQL Server 2016. Accessed October 2026.
23. Microsoft Lifecycle, SQL Server 2017. Accessed October 2026.
24. Microsoft Lifecycle, SQL Server 2019. Accessed October 2026.
25. Microsoft Lifecycle, SQL Server 2022. Accessed October 2026.
26. Microsoft Lifecycle, SQL Server 2025. Accessed October 2026.
27. endoflife.date API, Windows Server (cross-check). Accessed October 2026.