Patch Tuesday Guide: Planning Monthly Microsoft Updates

Every month Microsoft ships a cumulative security release on the same day, and organisations that have not planned for it either fall behind on exploited flaws or break production by rushing. Patch Tuesday is predictable, which is its value: the date, the content type and the release channels are known in advance, so the work of triage, testing, approval and deployment can be scheduled like any other recurring operation. This guide covers the Microsoft release calendar, how to read the Security Update Guide, a triage method for the first 48 hours, ring design, hotpatch, rollback options including Known Issue Rollback, and the Windows 10 end of support and Extended Security Updates position. It is written for Windows, endpoint and vulnerability teams who own the monthly cycle. It does not repeat the general patching programme (SLAs, tooling models, third-party applications); for that, see the Patch Management Guide.

Key takeaways

The date is fixed: the monthly security update is published on the second Tuesday of each month, typically at 10:00 AM Pacific Time, so a UK team sees it at 17:00 or 18:00 local time depending on daylight saving.
Updates are cumulative: each monthly update includes earlier security fixes and the previous month's optional preview content, so skipping a month does not leave you two updates behind, but it does leave every flaw in both months open.
Triage on exploitation, not on count: start with flaws Microsoft marks "Exploitation Detected", anything added to the CISA KEV catalog, and internet-facing server roles; the headline number of CVEs tells you very little.
Out-of-band updates break the rhythm: they are always cumulative, supersede the prior monthly update and must be deployed off-cycle, so the process needs an emergency lane that reuses the same rings.
Rollback is narrower than people assume: Known Issue Rollback only reverts non-security changes, hotpatch has no automatic rollback, and uninstalling a security update reopens the flaw. Plan rollback as an exception path, not a safety net.

The Microsoft release calendar

Microsoft documents several release types for Windows. Knowing which one has arrived tells you whether it is mandatory, whether it needs a restart and which channel will carry it.

Release	When	Content	How to treat it
Monthly security update ("B week", Patch Tuesday, latest cumulative update)	Second Tuesday, typically 10:00 AM Pacific	New and previous security fixes, plus non-security content from the prior month's preview	Mandatory. The anchor of the monthly cycle. Available through Windows Update, WSUS and the Microsoft Update Catalog
Optional non-security preview ("D week")	Typically the fourth week	Cumulative non-security fixes and features that will ship in the next B release	Install on a validation ring to find breakage two weeks early. Offered only to the most recent supported Windows versions
Out-of-band (OOB)	As needed	A fix for a newly identified issue or vulnerability	Critical OOB updates reach WSUS and Windows Update client policies automatically; non-critical OOB updates are in the Update Catalog only, so check before assuming coverage
Hotpatch	Eight months a year	Security fixes only, applied to running code without a restart	Requires a quarterly baseline cumulative update with restart in January, April, July and October
Annual feature update	Second half of the calendar year	New Windows version	Separate project. Support runs 24 months for Home and Pro and 36 months for Enterprise and Education

Checkpoint cumulative updates: from Windows 11, version 24H2, Microsoft periodically releases cumulative updates as checkpoints. Devices on Windows Update or WSUS still install the latest monthly update regardless, and Microsoft states that no change to the update process is needed.
Not only Windows: Patch Tuesday also carries fixes for Office and Microsoft 365 Apps, Exchange Server, SharePoint Server, SQL Server, .NET, Visual Studio and other products. Microsoft 365 Apps follow their own update channel, so a Patch Tuesday Office fix reaches Monthly Enterprise Channel devices on that channel's schedule rather than through WSUS.

Reading the Security Update Guide

The Microsoft Security Update Guide at msrc.microsoft.com/update-guide is the authoritative list for each release. It is a JavaScript application with filters by product, platform, severity and release date, and the same data is available programmatically through the MSRC Security Updates API, which publishes each month in the Common Vulnerability Reporting Format (CVRF). Microsoft publishes a PowerShell module, MsrcSecurityUpdates, that pulls the monthly document so that a team can build its own triage sheet automatically on the evening of release.

Two Microsoft ratings appear against each CVE and they answer different questions.

Field	Values	What it tells you
Severity (Microsoft rating)	Critical, Important, Moderate, Low	Worst theoretical outcome if exploitation succeeds. Critical means code execution without user action, including worm scenarios. Important covers compromise of confidentiality, integrity or availability, even with a prompt
Exploitability Index	0 Exploitation Detected, 1 Exploitation More Likely, 2 Exploitation Less Likely, 3 Exploitation Unlikely	Microsoft's assessment of whether working exploits exist or are likely. "Exploitation Detected" means Microsoft knows the flaw has been exploited
Publicly disclosed / Exploited flags	Yes or No	Whether details were public before release and whether exploitation was seen. A "Yes" on Exploited is your zero-day signal
FAQ and Mitigations / Workarounds	Free text	Conditions that make a system vulnerable (a role, a feature, a registry setting) and interim mitigations

Microsoft states that its severity system assumes exploitation will be successful and is separate from the Exploitability Index. An "Important" elevation of privilege flaw with "Exploitation Detected" usually outranks a "Critical" flaw rated "Exploitation Unlikely", because attackers chain local privilege escalation (MITRE ATT&CK T1068) with initial access they already have. The Vulnerability Prioritisation Guide covers how to combine these signals with EPSS and SSVC.

The first 48 hours: a triage routine

The work that most improves Patch Tuesday outcomes happens before any device installs anything. A routine that runs the same way every month:

Tuesday evening (UK): pull the release through the API or the Security Update Guide, and the Windows release health known issues pages for each Windows version you run. Build a sheet of CVEs mapped to products you actually have, using your software inventory rather than Microsoft's full product list. See the Asset Inventory and CMDB Security Guide.
Flag the emergency tier: any CVE marked Exploited, rated "Exploitation Detected", or added to the CISA Known Exploited Vulnerabilities catalog that day. CISA's Binding Operational Directive 22-01 gives US federal agencies two weeks to remediate KEV entries with CVE IDs from 2021 onwards; many private organisations adopt the same clock for internet-facing systems.
Flag exposure: server roles reachable from the internet or from many users (Exchange, SharePoint, RD Gateway, IIS, DNS, print servers, domain controllers). A remote code execution flaw in a role you expose (ATT&CK T1190 for public-facing applications, T1210 for remote services inside the network) moves up a tier.
Read the FAQ for conditions: many CVEs only apply when a feature is enabled. Record whether a mitigation exists and whether it can be applied faster than the update.
Check for manual steps: some fixes ship disabled or in an audit phase and need a registry key, a policy, or a later enforcement phase. Put enforcement dates in the change calendar, because a missed enforcement step looks like a patched system to a scanner that only checks the build number.
Wednesday: publish the triage note to change management with the tier for each product, the ring schedule and any manual steps. Agree the emergency tier deployment the same day.

Ring design for the monthly cycle

The Patch Management Guide explains deployment rings in general. For Patch Tuesday specifically, the rings should be tied to calendar days after release so that every month has the same shape and the emergency lane can compress it.

Ring	Typical membership	Standard timing	Emergency tier timing
Validation	IT devices and test VMs that also take the D week preview	Day 0 to 1	Hours
Pilot	1 to 5 per cent of devices, chosen to cover every hardware model, line-of-business application and server role	Day 1 to 3	Day 0 to 1
Broad workstations	Most user devices	Day 4 to 10	Day 1 to 3
Servers, non-critical	File, print and application servers with redundancy	Next maintenance window, within 14 days	Within 72 hours
Servers, critical and domain controllers	Tier 0 systems, clusters patched node by node	Within 14 to 21 days	Within 72 hours, node by node

Windows Update client policies (formerly Windows Update for Business): quality updates can be deferred for up to 30 days and paused for up to 35 days. Use deferral per ring to create the stagger, and use deadlines (days after publication before the update must install) with a grace period (days before a forced restart) so devices cannot stall indefinitely.
Windows Autopatch: Microsoft's managed service runs rings and Autopatch groups through Intune, covers Windows quality, feature, hotpatch and driver updates plus Microsoft 365 Apps, Edge and Teams, and states a goal of keeping at least 95 per cent of Up to Date devices on the latest quality update. Since April 2025 it is available with Business Premium, A3 and E3 or higher, and F3. See the Microsoft Intune Guide.

Hotpatch: fewer restarts, same cadence

Hotpatch installs the monthly B release security fixes into running code without a restart. It changes how often devices restart, not how often you patch.

Windows 11 eligibility: Windows 11, version 24H2 or later, on the latest baseline, with virtualisation-based security (VBS) running; licensed through Windows 11 Enterprise E3 or E5, Microsoft 365 F3, Windows 11 Education A3 or A5, Microsoft 365 Business Premium or Windows 365 Enterprise. Arm64 devices must have CHPE disabled (HotPatchRestrictions=1 under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management, or the DisableCHPE policy).
Turning it on: in the Intune admin centre, a Windows quality update policy with "When available, apply without restarting the device (Hotpatch)" set to Allow. Existing ring deferrals and active hours still apply. Ineligible devices silently receive the normal cumulative update with a restart, so report on which update type each device actually received.
Baseline months: January, April, July and October are baseline months with a restart; the other eight months are hotpatch months. Microsoft may issue an unplanned baseline when an urgent fix cannot ship as a hotpatch, and that month needs a restart.
Windows Server: hotpatch is supported on Windows Server 2022 and 2025 Datacenter: Azure Edition images, and on Windows Server 2025 Standard and Datacenter connected through Azure Arc. Non-security updates, .NET and driver or firmware updates are outside the programme and still need restarts.
Rollback: neither client nor server hotpatch supports automatic rollback. Recovery means uninstalling the hotpatch, installing the last cumulative update or baseline, and restarting.

Rollback and known issues

Rollback planning for Patch Tuesday starts from one fact: removing a security update reopens every flaw it fixed, including any being exploited. Use the least destructive option that solves the problem.

Option	What it reverts	When to use it	Limits
Known Issue Rollback (KIR)	One specific non-security change in an update	Microsoft publishes a KIR for a confirmed regression	Never reverts security fixes. Managed devices need the KIR policy MSI (ADMX) deployed through Group Policy, or ADMX ingestion in Intune, then a restart. Lifespan of a few months
Documented workaround or registry setting	A behaviour change introduced by a hardening fix	Microsoft documents a compatibility mode during an enforcement phase	Usually time-limited. Track the date compatibility mode ends
Pause the ring	Nothing installed; stops further spread	Pilot shows a problem and no fix is yet known	Holds every security fix for that ring. Maximum 35 days
Uninstall the cumulative update	The whole month	Business-stopping failure with no KIR or workaround	Reopens all fixed CVEs. Record a risk acceptance, add compensating controls, set a re-deploy date
Restore from snapshot or image	The whole system state	Server fails to boot or a cluster node is lost	Data written since the snapshot is lost. Test restore time in advance

KIR is available for Windows 10, version 1809 and later and Windows Server 2019 and later. Unmanaged devices receive KIRs automatically; enterprise-managed devices do not, which is why a known issue fixed for consumers can persist in a managed estate until someone deploys the policy. Intune deployment of KIR policies requires the July 2022 cumulative update (KB5015878) or later. Check the Windows release health known issues page for each version you run before declaring a regression your own.

Windows 10 end of support and Extended Security Updates

Windows 10 reached end of support on 14 October 2025. Version 22H2 was the final feature update. Without Extended Security Updates (ESU), Windows 10 devices still work but receive no security fixes, so they drop out of the Patch Tuesday cycle entirely. LTSC editions follow their own lifecycles.

Commercial ESU: up to three years after end of support, sold annually through volume licensing at USD 61 per device for Year One, with the price doubling each year. Purchase is cumulative: joining in Year Two means paying for Year One too. Year One started in November 2025.
Prerequisites and activation: devices must run Windows 10, version 22H2 and be activated with the ESU Multiple Activation Key from the Microsoft 365 admin centre. A device without a working ESU key receives no ESU updates, which is a silent failure unless you report on it.
Cloud and virtual exceptions: ESU is included at no extra cost for Windows 10 in Windows 365, Azure Virtual Desktop, Azure virtual machines and several other Microsoft-hosted services listed by Microsoft.
Scope of ESU: Critical and Important security updates only. No new features, no non-security fixes, and support only for ESU activation and regression issues.
Treat ESU as a migration runway: track ESU devices as a separate ring with an owner and a retirement date. See the Patch Management Guide on end-of-life software.

Changes that span several Patch Tuesdays

Some Microsoft security changes arrive in phases across months: a fix ships disabled, an audit phase logs what would break, and an enforcement phase turns it on for everyone. These are where Patch Tuesday most often causes outages, because the breakage arrives in a month nobody expected.

Secure Boot certificate renewal: the Microsoft Corporation KEK CA 2011 expired on 24 June 2026, the Microsoft UEFI CA 2011 on 27 June 2026, and the Microsoft Windows Production PCA 2011, which signs the Windows boot loader, expires on 19 October 2026. Replacement 2023 certificates are needed in the KEK and DB. Devices without them still boot and take normal Windows updates, but cannot receive new early-boot protections such as Boot Manager and revocation list updates. Microsoft publishes playbooks through Windows release health; firmware updates from the device maker may be needed. See the Firmware and Boot Security Guide.

Where identity fits

Patching tools hold privileged machine credentials: Configuration Manager network access and client push accounts, WSUS servers and Intune administrator roles can push code to every device. Treat them as Tier 0 non-human identities with owners, vaulted credentials and alerting on change. The Stryker attack showed what one hijacked Intune administrator account can do to an estate. See the Local Administrator Password Solution (LAPS) Guide for local admin accounts on patched devices.

Detection and measurement

What to collect: per-device installed cumulative update build (the OS build revision, not just "updates installed"), update type received (hotpatch or LCU), last successful scan, pending restart state, deferral and pause settings, and ESU activation status for Windows 10.
What to alert on: devices that report as compliant but whose build revision is older than the current month, rings left paused past their review date, and changes to update policies or approval rules outside change control.
Verify with a scanner: authenticated vulnerability scans after day 10 confirm what the management tool claims. See the Vulnerability Scanning Guide.

Metrics that show the cycle is working:

Percentage of devices on the current month's build at day 7, day 14 and day 30, per ring.
Median time from release to deployment for emergency tier CVEs (target: within the KEV clock you adopted).
Number of devices more than one cumulative update behind (target: trending to zero).
Patch-caused incidents per month, and the share caught in the validation or pilot ring rather than broad deployment.
Count of Windows 10 devices without valid ESU, and of rings paused longer than seven days.

Framework mapping

Framework	Reference	Relevance to the monthly cycle
NIST SP 800-53 Rev. 5	SI-2 Flaw Remediation; SI-2(2) Automated Flaw Remediation Status; SI-2(3) Time to Remediate Flaws	Install updates within defined timeframes; measure time to remediate
NIST SP 800-53 Rev. 5	CM-3 Configuration Change Control; CM-4 Impact Analyses	Monthly change record, ring testing and approval
NIST SP 800-53 Rev. 5	SI-5 Security Alerts, Advisories, and Directives	Receiving and acting on MSRC releases and CISA KEV additions
NIST CSF 2.0	ID.RA-01; PR.PS-02	Vulnerabilities identified and recorded; software maintained, replaced and removed commensurate with risk
ISO/IEC 27001:2022 Annex A	A.8.8 Management of technical vulnerabilities; A.8.32 Change management	Timely remediation and controlled change
CIS Controls v8.1	Control 7, Safeguards 7.3 and 7.4	Automated operating system and application patch management
MITRE ATT&CK / D3FEND	T1190, T1210, T1068, T1203; D3FEND D3-SU Software Update	Exploitation techniques the monthly fixes close; the countermeasure itself

Common failure patterns

Treating the release as one decision: one approval for everything means the exploited flaw waits for the slowest server window. Split the emergency tier from the rest every month.
Patching without remediating: in the ToolShell SharePoint exploitation of July 2025, CVE-2025-53770 and CVE-2025-53771 were bypasses of earlier fixes for CVE-2025-49704 and CVE-2025-49706, emergency updates followed outside the monthly cycle, and attackers who had already stolen ASP.NET machine keys kept access after patching until the keys were rotated and IIS restarted. An OOB lane needs a compromise check and secret rotation step, not just deployment.
Indefinite pauses: a ring paused for a known issue and never resumed, discovered months later in an audit.
Trusting "installed" status: the tool reports success while devices are pending restart, the update is staged but not committed, or a hardening fix needs a manual registry step.
Unrepresentative pilot: a pilot ring of IT laptops that never runs the finance application or the print driver that breaks.
Forgotten Windows 10: devices without ESU activation that look healthy because nothing new is offered to them.

Practitioner checklist

Put the second Tuesday, the D week preview and quarterly hotpatch baseline months into the change calendar for the year.
Automate the monthly pull from the MSRC API into a triage sheet mapped to your software inventory.
Define the emergency tier: Exploited or "Exploitation Detected", KEV-listed, or internet-facing remote code execution.
Set ring deferrals, deadlines and grace periods so every device reaches the current build within your SLA.
Make the pilot ring cover every hardware model, critical application and server role.
Document rollback order: KIR, workaround, pause, uninstall with risk acceptance, restore.
Track phased enforcement dates (Secure Boot certificates, authentication hardening) separately from monthly approvals.
Report on Windows 10 ESU activation and hotpatch eligibility per device.
Protect patching platform administrator roles and service accounts as Tier 0 identities.
Review build compliance at day 7, 14 and 30 and publish the results.