Windows Security · Patch Tuesday & Vulnerabilities · Lesson 1 of 5

Patch Tuesday

Microsoft's monthly security fixes, and how to read the list.

Second Tuesday, every month

A vulnerability is a mistake in software that an attacker could use to get in. A patch is a fix that closes it.

Microsoft releases most of its security patches on one planned day. Patch Tuesday is the second Tuesday of each month. The fixes come out in the morning, US Pacific time.

Why one set day? IT teams, the people who look after a company's computers, can plan for it. They test the fixes, then roll them out together.

Microsoft lists every fix on a public page called the Security Update Guide. Each row is one vulnerability. Look for:

• A CVE id, which looks like CVE, a year, then a number. In Mobile Track 7 you met CVEs, the shared id numbers the whole industry uses for known holes.
• The product, such as Windows, Office or Edge.
• The severity: Critical, Important, Moderate or Low. Critical usually means an attacker could take over a PC with little or no help from you.
• The impact, what an attacker could do. For example, run their own code, or gain more rights than they should have.

Now the most important column. An exploit is a working way to use a vulnerability. When Microsoft marks a row Exploitation Detected, attackers are already using that hole in real attacks. That fix goes to the top of the list, whatever its severity says.

Here is the good news for a home or small office PC. You don't install each fix one by one. Windows bundles the month's fixes into one cumulative update. That is a single update holding this month's fixes plus all earlier ones. Install it, and every Windows hole on the list is closed.

On the practice computer, read this month's update list and find the hole that is already being exploited. Then see which single update fixes them all, and check Update history to confirm it installed.

Out-of-band and urgent fixes

Most months, Patch Tuesday is the whole story. Sometimes a problem can't wait four weeks.

An out-of-band update is one Microsoft releases outside the normal schedule. "Out of band" just means off the usual timetable. Microsoft does this when a hole is being attacked widely, or when a monthly update caused a serious problem that needs a quick repair.

Windows Update finds out-of-band updates the same way it finds monthly ones. If your PC installs updates on its own, you usually get them without doing anything. A restart may still be needed to finish.

Later in the month you may also see an optional preview update. It holds non-security fixes being tried early. Home users can skip it. Its fixes arrive in next month's Patch Tuesday update anyway.

Why not wait a few weeks before patching? Once a fix is public, attackers can compare the old and new code to work out where the hole was. Then they build attacks for PCs that haven't updated. The longer you wait, the more likely those attacks exist.

You already know how Windows Update works. Here is a simple monthly routine built on it:

1. On or just after Patch Tuesday, open Settings, then Windows Update, and select Check for updates.
2. Install what is offered, and restart when asked. Many fixes don't take effect until the restart.
3. Open Update history to see that it installed.
4. If the news mentions an urgent out-of-band fix, check again that day.

One more habit. Pausing updates is handy before a big trip or deadline. Just remember that a pause also holds back security fixes, so keep pauses short.