ESU Coverage Periods and Update Types

Extended Security Updates (ESUs) can provide security patches for select versions of Windows Server and SQL Server that are otherwise no longer supported by Microsoft but vary in terms of what updates are offered, and under what terms. This chart summarizes and details the products for which Microsoft currently offers ESUs and the duration and type of updates offered. Dates marked in italics have already passed at time of publication.

ESUs are typically offered for only three years after the end of Extended support. When products with ESUs available are deployed on Azure, Stack HCI, or Stack Hub, Windows Server 2008 and 2008 R2 and SQL Server 2008 and 2008 R2, Microsoft offers an additional fourth year of ESU coverage. However, only three years of ESU coverage have been announced for Windows Server 2012 and 2012 R2, and SQL Server 2012 and 2014. SQL Server 2014 ESUs have been announced but are not yet available for purchase.

For SQL Server, Microsoft offers security updates only for vulnerabilities it classifies as “critical,” which could allow code execution without user interaction or prompts in the case of certain vulnerabilities.