What Is Patch Tuesday? Microsoft's Monthly Update Day Explained

Patch Tuesday is the second Tuesday of every month, the day Microsoft bundles that month's Windows and software security fixes into one coordinated release, typically published around 10:00 a.m. Pacific Time. Other vendors have historically timed their own updates to the same day, so IT teams can plan one patching window instead of reacting to fixes all month long. The next one lands on November 10, 2026, two days from now. Here's what the term actually means, why the schedule exists, and how to get ready without guessing at specifics Microsoft hasn't published yet.

What is Patch Tuesday?

"Patch Tuesday" is the informal, industry-wide name for the day Microsoft ships its monthly security update for Windows, Microsoft Office, and other supported products. Microsoft's own documentation calls this the "monthly security update" or "B release" internally, but almost nobody outside Redmond uses that name. It's a cumulative update, meaning it includes every previously released fix plus whatever is new that month, so installing it brings a device fully up to date rather than patching one issue at a time.

The term has outgrown Microsoft specifically. Because so much of the security industry — researchers, CISOs, sysadmins, reporters — organized their work around Microsoft's schedule, "Patch Tuesday" became shorthand for any vendor's regularly scheduled update day, even when people are talking about Adobe or Oracle rather than Windows.

Why the second Tuesday? A short history

Microsoft didn't always ship updates on a fixed day. Through the early 2000s, security fixes went out whenever they were ready, which meant IT departments were testing and deploying patches on no predictable schedule at all. According to Wikipedia's account of the practice, Microsoft formalized a monthly release day in October 2003, partly in response to the cost and chaos of worms like Blaster, which had exploited an unpatched Windows flaw just months earlier.

Tuesday was a deliberate choice, not an arbitrary one. Releasing on Tuesday gives administrators a full business day of Monday to deal with anything that broke over the weekend before a new patch lands, and it leaves the rest of the week — rather than a weekend — to handle any problems the new patch itself introduces. The "second" Tuesday, rather than the first, gives Microsoft's own teams a few extra days past the end of the month to finish validation.

The schedule also produced some durable industry slang. The day after release is sometimes called "Exploit Wednesday," because attackers can reverse-engineer a patch to figure out exactly what vulnerability it closes — and then target anyone who hasn't installed it yet. Administrators who spend the following days firefighting side effects from a bad update have their own nickname for it: "Crash Wednesday."

How Patch Tuesday actually works

Microsoft's update release cycle documentation breaks the monthly cadence into a few distinct release types, which is useful vocabulary if you're trying to follow along:

Most organizations treat the monthly security update as effectively mandatory, since it's the primary channel for closing newly disclosed vulnerabilities. The optional preview update exists so IT administrators can test upcoming non-security changes before they're folded into the following month's mandatory release — it's a dry run, not a security patch in itself.

Out-of-band updates are the exception that breaks the schedule on purpose. When a flaw is severe enough, or already being exploited, Microsoft doesn't wait for the next second Tuesday — it ships a fix immediately. Critical OOB updates are pushed automatically through Windows Update and WSUS, just like a normal Patch Tuesday release.

How severe is "severe"? Reading Microsoft's ratings

Each fix in a Patch Tuesday release carries a severity rating from Microsoft's Security Update Severity Rating System, which is separate from (though related to) a vulnerability's CVSS score. The rating reflects the worst realistic outcome if the flaw were exploited, not how likely that is:

A high severity rating and a high CVSS score don't always move together — Microsoft's own guidance notes that severity measures worst-case impact, while a separate Exploitability Index estimates how likely working exploit code is to appear within 30 days. That gap is exactly why a flaw can carry a maximum CVSS score and still ship with no required action, as a recent Microsoft Entra ID vulnerability demonstrated: the score reflected theoretical impact, not real-world exposure.

For prioritization beyond Microsoft's own scale, security teams also cross-check fixes against CISA's Known Exploited Vulnerabilities (KEV) catalog, which tracks flaws that attackers are confirmed to be using right now, each with a federally mandated remediation deadline. A Patch Tuesday fix for a KEV-listed CVE should jump to the front of any patching queue, regardless of its Microsoft severity label.

It's not just Microsoft

Microsoft popularized the term, but it never had exclusive rights to the second Tuesday. Adobe aligned its Flash Player updates to the same day starting in 2012, Oracle has long run its own quarterly Critical Patch Update cycle, and SAP calls its equivalent "Security Patch Day." The underlying logic is the same everywhere it's adopted: batching fixes into a predictable release window lets enterprise IT teams schedule testing and rollout instead of patching reactively, update by update.

Other ecosystems run their own monthly cadence on different days entirely. Android's monthly security bulletin, for instance, follows its own release calendar independent of Microsoft's schedule — November's Android patch, closing a zero-click RCE flaw, is a reminder that "monthly patch day" is now a near-universal pattern across major platforms, not a Microsoft-only habit.

What to expect on November 10, 2026

Based on Microsoft's published release cadence, November 10, 2026 is the scheduled date for this month's monthly security update, landing around 10:00 a.m. Pacific Time as usual. Microsoft has not published the contents of that release at the time of writing — the specific CVEs, affected products, and severity breakdown only become public once the update guide goes live that morning, so treat any claim about "what November's Patch Tuesday fixes" made before then as speculation, not confirmed information.

What is already confirmed, and worth flagging regardless of what the fixes turn out to be: per Microsoft's own Windows 11, version 23H2 release health page, November 10, 2026 is also the date Enterprise and Education editions of Windows 11 23H2 reach end of updates. Microsoft's lifecycle listing confirms the same cutoff. After this release, devices still running 23H2 Enterprise or Education will no longer receive monthly security updates at all — making this particular Patch Tuesday a deadline, not just a routine patch day, for any organization that hasn't moved those devices to a newer, supported version of Windows 11. (23H2 Home and Pro editions already reached the same cutoff back on November 11, 2025.)

Expect the usual pattern otherwise: a mix of Windows, Office, and related product fixes, most carrying Important or Critical ratings, with full technical detail appearing in Microsoft's Security Update Guide the moment the release goes out.

How consumers should respond

For most home users, Patch Tuesday requires almost no action, because Windows installs these updates automatically by default. Still, a few habits make it less disruptive, drawn from Microsoft's own Windows Update FAQ:

• Check manually if you're impatient. Go to Settings > Windows Update (or Update & Security on Windows 10) and select "Check for updates" rather than waiting for it to arrive on its own schedule.
• Don't disable updates long-term. You can pause them temporarily, but Windows enforces a limit — once you hit it, you must install the pending updates before pausing again.
• Keep laptops plugged in and connected around the second Tuesday evening so installations aren't interrupted mid-update.
• Confirm your version is still supported. Windows 10 reached the end of free security updates on October 14, 2025, so devices still on it no longer receive Patch Tuesday fixes unless enrolled in Extended Security Updates.

How IT teams should respond

Enterprises can't simply let updates install themselves, since an untested patch hitting thousands of managed endpoints at once is its own risk. A reasonable monthly routine looks like this:

• Triage by severity and exploitability first. Cross-reference the day's Critical and Important fixes against CISA's KEV catalog before anything else — actively exploited flaws don't wait for your normal testing window.
• Use the prior month's preview update as a head start. Non-security changes in that "D week" release are largely the same code landing in this month's mandatory update, so issues found during preview testing should already be flagged.
• Stage the rollout. Deploy to a pilot ring first through Windows Update for Business, Intune, WSUS, or Configuration Manager, then expand once nothing regresses.
• Watch for safeguard holds and known issues. Microsoft's release health pages document compatibility holds and known issues by build, which can explain why an update hasn't reached every device yet.
• Keep an OOB watch open. A quiet second Tuesday doesn't mean the month is over — an actively exploited bug can trigger an out-of-band release at any point before the next scheduled cycle.

The same discipline applies outside the Windows ecosystem. The recent OpenSSH flaw patched in Alpine Linux is a useful reminder that "patch promptly on disclosure" matters for infrastructure software on its own release cycle too, not only for the specific vendors that happen to batch fixes into a monthly Tuesday.

Frequently asked questions

Is Patch Tuesday an official Microsoft term?
No. Microsoft's own documentation calls it the "monthly security update," and internally refers to it as the "B release." "Patch Tuesday" is industry slang that stuck so firmly Microsoft now uses it informally too.

What is "Exploit Wednesday"?
The informal name for the day after Patch Tuesday. Attackers can analyze a newly released patch to work out exactly which vulnerability it closes, then target systems that haven't installed it yet — so the window between release and update is when risk is highest.

Does Windows 10 still get Patch Tuesday updates?
Not for free. Mainstream Windows 10 support ended October 14, 2025, so unenrolled devices no longer receive the monthly security update; only machines enrolled in Extended Security Updates continue to get fixes.

Why do out-of-band updates happen outside the normal schedule?
When a flaw is already being exploited or is severe enough to not wait, Microsoft releases a fix immediately rather than holding it for the next second Tuesday. These are cumulative and supersede whatever came before them.

Do other companies besides Microsoft use "Patch Tuesday"?
The name is Microsoft's, but Adobe, Oracle, and SAP have each run their own monthly or quarterly update cycles historically aligned to a predictable release day, and the broader security industry now uses "Patch Tuesday" loosely to describe any vendor's scheduled update day.

How do I know which November 10, 2026 fixes apply to my systems?
Check Microsoft's Security Update Guide once the release goes live that morning, filter by the products and Windows versions you run, and prioritize anything rated Critical or listed in CISA's KEV catalog first.

What's next

Microsoft's Security Update Guide will publish the full list of November 10, 2026 fixes the morning the release goes out; that's the place to check for specifics once they're confirmed, rather than relying on pre-release speculation. Beyond this month, the mechanism doesn't change: expect the next monthly security update on the second Tuesday of December, a preview update in the final week of November, and any out-of-band release in between if something urgent surfaces. For now, the useful move is making sure update settings aren't paused, confirming which Windows versions in your environment are still inside their support window, and having a triage plan ready for the moment this month's severity list goes live.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage