What is Patch Tuesday? Microsoft's monthly security update cycle, defined

Patch Tuesday is the common name for Microsoft's monthly security update, published on the second Tuesday of each month, typically at 10:00 AM Pacific Time. Each release fixes vulnerabilities across Windows, Office, server products and developer tools, and Microsoft notes that most organizations treat the monthly security update as mandatory.

What is in a release

Microsoft's update release cycle page lists Patch Tuesday alongside Update Tuesday, B week release and latest cumulative update as names for the same release. Monthly Windows updates are cumulative, carrying new and previously released security fixes. The October 2026 release notes list 1,453 Microsoft CVEs across 227 distinct updates, 1,105 of them in Windows.

Two flags matter most. The Security Update Guide marks a vulnerability Exploited when it was exploited before the update was released, and Publicly Disclosed when it was public before release. In October 2026 the notable items were CVE-2026-96951 in Windows Shell, with exploitation detected, and CVE-2026-108398 in .NET Framework, publicly disclosed.

What it is not

Patch Tuesday is not Microsoft's only release. An optional non-security preview arrives in the fourth week of the month, and out-of-band updates ship whenever an issue cannot wait for the next cycle. Nor is it a standard: the name describes one vendor's schedule, not a rule for the industry.

What a patch desk does with it

On the day, read the release notes, pull every Exploited and Publicly Disclosed fix to the top, and check those CVEs against the KEV catalog. CISA added CVE-2026-96951 to KEV on 13 October 2026, the second Tuesday of the month, with a due date three days later. Test the cumulative update on a pilot group, then deploy, exposed systems first.

Keep the rest of the release on the normal cycle unless exposure or an EPSS score says otherwise. Watch for out-of-band follow-ups in the days after, and reread the notes before closing the month: the October 2026 page carries a release stamp of 18 October 2026, five days after the second Tuesday.

Where it appears on Daily CISO

Patch Tuesday lists each recent release with its Critical, exploited and publicly disclosed fixes, taken from Microsoft's Security Update API. Must-patch shows which flaws CISA has added to KEV, and the daily briefing carries the day's patch news.

Related terms

Zero-day vulnerability, n-day vulnerability, Known Exploited Vulnerabilities (KEV) catalog and Common Vulnerability Scoring System (CVSS).