Patch Tuesday is the regularly scheduled monthly release of security and quality updates for Microsoft Windows and other Microsoft products, published on the second Tuesday of each month, usually at about 10:00 a.m. Pacific Time. In the maintenance of operating systems, it is the fixed rhythm around which home users, IT departments and security teams plan the testing and installation of patches.
The predictable schedule exists so that administrators can prepare in advance instead of reacting to updates arriving on random days. Other vendors, including several major software and hardware companies, publish their own security updates on the same day, which makes the second Tuesday a key date in vulnerability management.
How Patch Tuesday works
On Patch Tuesday, Microsoft publishes a cumulative update for each supported Windows version together with updates for products such as Office, Exchange, SQL Server and development tools. Each vulnerability fixed receives a CVE identifier, a severity rating and a description in Microsoft’s security update guide, along with notes on whether it was already publicly disclosed or actively exploited.
Because Windows updates are cumulative, the latest monthly package contains all earlier fixes for that version. A computer that missed several months needs only the newest cumulative update, although a current servicing stack component may be required first so that the update can install correctly.
Patch Tuesday is part of a broader monthly cadence. The table below shows the main types of Windows releases and when they appear.
| Release type | Timing | Content |
|---|---|---|
| Monthly security update | Second Tuesday (Patch Tuesday) | Security fixes plus previous quality fixes |
| Optional preview update | Usually the fourth week | Non-security fixes released early for testing |
| Out-of-band update | Any day when urgent | Emergency fix for a critical or exploited flaw |
| Feature update | Typically once a year | New Windows version with new features |
| Driver and firmware update | Continuous | Hardware-specific fixes from manufacturers |
The fixes in an optional preview update are normally folded into the next Patch Tuesday release, which allows organizations to test them a few weeks ahead of the mandatory security update.
Microsoft adopted the monthly schedule in 2003, replacing a practice of releasing patches whenever they were ready. Other platforms follow different models: Apple ships macOS security fixes in point releases and rapid security responses without a fixed day, and Linux distributions publish security advisories continuously as upstream fixes become available. The Windows approach trades some speed for predictability, which large organizations generally value.
Severity ratings and prioritization
A single Patch Tuesday often fixes dozens of vulnerabilities, and the number varies considerably from month to month. Administrators cannot treat all of them equally, so they rely on severity ratings, exploit status and exposure to decide what to deploy first.
| Severity | Meaning | Typical response |
|---|---|---|
| Critical | Exploitation could allow code execution without user interaction | Deploy as quickly as testing allows |
| Important | Compromise of data or privilege escalation possible | Deploy in the normal monthly cycle |
| Moderate | Impact reduced by configuration or defaults | Deploy with regular updates |
| Low | Impact difficult to exploit or minimal | Deploy when convenient |
Severity alone is not sufficient. A vulnerability marked Important that is already exploited in the wild often deserves faster action than a Critical flaw in a component the organization does not use. Many teams combine the vendor rating with CVSS scores, known exploitation lists and their own asset inventory.
Deploying Patch Tuesday updates
Home computers install monthly updates automatically through Windows Update, usually within days. Organizations instead use staged rollouts, often called rings, so that a faulty update affects a small test group before it reaches every computer.
| Ring | Devices included | Typical delay after release |
|---|---|---|
| Test ring | IT staff and lab machines | Same day to two days |
| Pilot ring | Representative users from each department | About one week |
| Broad ring | Most business computers | One to three weeks |
| Critical systems | Servers and specialized devices | After validation and maintenance window |
Tools such as Windows Update for Business, Microsoft Intune, Configuration Manager and WSUS let administrators set deferral periods, deadlines and restart windows. Newer Windows editions in managed environments can also use hotpatching, which applies many security fixes without an immediate restart between periodic baseline updates.
On personal computers, the most useful settings are active hours, which prevent restarts during the hours the device is normally used, and a short pause option for important deadlines. Pausing should remain temporary: Windows limits how long updates can be paused, and the computer should be restarted within a few days of Patch Tuesday so the fixes actually take effect.
Risks, criticism and common mistakes
The fixed schedule has a downside often described as Exploit Wednesday: once patches are public, attackers can compare updated and old files to locate the flaw and build exploits within days. Unpatched computers become more exposed after Patch Tuesday, not less, which is why long delays are risky.
- Delaying updates indefinitely to avoid problems leaves known, documented vulnerabilities open.
- Deploying to every machine at once turns a rare faulty update into an organization-wide outage.
- Ignoring restarts means many updates are downloaded but not active until the computer reboots.
- Overlooking non-Windows software leaves browsers, runtimes and third-party applications unpatched.
- Skipping backups or restore points before updating critical systems complicates rollback if an update fails.
When an update does cause trouble, Windows allows uninstalling the latest quality update from recovery options, and Microsoft may use known issue rollback to disable a problematic change remotely without a new package. These safety nets reduce, but do not remove, the need for testing.
A plain-language summary
Patch Tuesday is the day each month when Microsoft fixes known problems in Windows and its other software. It always falls on the second Tuesday, so everyone knows when the repairs are coming.
Think of it as a scheduled monthly service for your computer. Most of the fixes close security holes that criminals could use, so the most important habit is simple: let the updates install and restart the computer when asked.
An example from practice
A regional hospital IT team manages about 1,500 Windows computers and 60 servers. On Patch Tuesday afternoon, the team reviews the release notes and sees that one fixed vulnerability is already being exploited in a network service used by its file servers.
The team installs the update on test machines the same evening, moves it to a pilot group of 100 computers the next day and schedules the file servers for an emergency maintenance window that weekend. The remaining fixes follow the normal two-week ring schedule.
When a printing problem appears in the pilot group, the team pauses the broad ring until a known issue rollback arrives. Prioritizing by real risk lets the hospital close the dangerous flaw within four days without disrupting clinical work.