Microsoft Patch Tuesday explained: a patch management process that works
Every month Microsoft releases security updates for its products. A clear process turns that monthly flood into manageable, prioritised work.
Updated October 2026 · 6 min read
Each Patch Tuesday, Microsoft publishes fixes for vulnerabilities in Windows, Office, Exchange, browsers and other products. Some months bring dozens of fixes, including critical flaws and zero-days already used by attackers. Unpatched systems remain one of the most common ways into an organisation.
What is Patch Tuesday?
Patch Tuesday is the second Tuesday of each month, when Microsoft releases its scheduled security updates. Each release lists the vulnerabilities fixed, identified by CVE numbers, with a severity rating and an indication of whether they are publicly known or actively exploited. Urgent fixes can also be released outside the schedule.
How to prioritise updates
| Priority | What to patch | Target time |
|---|---|---|
| Emergency | Actively exploited vulnerabilities (zero-days) | Within days |
| High | Critical flaws on internet-facing systems | Within one to two weeks |
| Standard | Other critical and important updates | Within the monthly cycle |
| Planned | Low-risk updates and feature changes | Next maintenance window |
Check whether a vulnerability is listed in the CISA Known Exploited Vulnerabilities catalogue. It is a strong signal that it needs urgent attention.
A patch management process that works
- Inventory: know every device, server and application you need to patch.
- Assess: review each release and rate updates against your environment.
- Test: deploy to a small pilot group first.
- Deploy in rings: pilot, then broad deployment, then critical servers in agreed windows.
- Verify and report: confirm installation and track compliance over time.
- Handle exceptions: document and mitigate systems that cannot be patched.
Beyond Microsoft
Third-party software such as browsers, PDF readers, Java, network devices and firmware also needs regular updates. Attackers often target these because they are patched less consistently.
Related serviceManaged IT & Security Services24/7 monitoring, patching, endpoint protection and service desk under clear SLAs.Explore managed services →Frequently asked questions
When is Patch Tuesday?
The second Tuesday of each month. Microsoft may release urgent out-of-band fixes at other times.
What is a zero-day vulnerability?
A flaw that attackers exploit before a fix is available or widely installed. These should be patched first.
Should we install updates immediately?
Test them on a pilot group first, but deploy actively exploited fixes as quickly as possible.
Can patching be automated?
Yes. Tools such as Microsoft Intune and Windows Autopatch automate much of the process, but someone still needs to monitor results and handle exceptions.