Patch Tuesday: Every Date Through 2027 and How IT Teams Roll It Out

Updated: November 2026

Microsoft ships its security fixes on one fixed day a month, and IT teams plan the whole week around it. Working out the date is easy, but knowing what lands, what goes first and when the last laptop is done takes more. This Patch Tuesday guide gives you every release date through 2027, what each release contains, and a day-by-day plan for the first week.

TL;DR

• What it is. Patch Tuesday is the second Tuesday of each month, when Microsoft ships security updates at 10:00 a.m. Pacific.
• Next dates. 8 December 2026, 12 January 2027 and 9 February 2027.
• Other releases. An optional preview lands in week four, and out-of-band fixes ship as needed.
• Rollout. Pilot on day 0-1, broad ring by day 7, stragglers by day 14, report by day 30.
• Priority. CISA KEV entries go first, then zero-days, then critical fixes on exposed systems.

Latest Patch Tuesday: November 2026

The exploited bug isn't in Windows. Its fix ships through Microsoft 365 Apps and Office LTSC rather than the Windows cumulative update, so check your Office update channel as well as the Windows rings.

November is also a hotpatch month, and Windows 11 version 23H2 Enterprise, Education and IoT Enterprise got their last update.

The full November breakdown, with the Critical fixes by server role and the Windows KBs, is the first entry in the archive at the end of this guide. This block is updated after every release.

What Is Patch Tuesday?

Patch Tuesday is the day Microsoft publishes its monthly security update for Windows, Office, Exchange, SQL Server and the rest of its products. It lands on the second Tuesday of every month, typically at 10:00 a.m. Pacific Time, per Microsoft's update release cycle. Inside Microsoft it's the "B week" release. You'll also see it called Update Tuesday or the latest cumulative update (LCU).

The time moves if you're not in California. 10:00 a.m. Pacific is 18:00 UTC for the November to March releases and 17:00 UTC from April to October, when the US is on daylight time. For the 10 November 2026 release, that's 13:00 in New York, 18:00 in London, 19:00 in Berlin and 05:00 on Wednesday in Sydney.

Microsoft formalized the schedule in October 2003, after the Blaster worm, so admins could plan for one predictable drop instead of patches arriving any day of the week. The Patch Tuesday history on Wikipedia covers the details.

Every release is cumulative. It carries all the earlier fixes for that version of Windows, so a machine that missed three months needs only the latest update.

The day after has its own nickname: Exploit Wednesday. Once a fix is public, attackers can compare the patched and unpatched files to find the bug, then go after machines that haven't updated. The time between the fix and your rollout is the patch window, and everything below is about keeping it short.

Patch Tuesday 2026-2027 Schedule

Every date below is the second Tuesday of the month. The hotpatch column matters if you've enrolled devices in hotpatch updates: baseline months need a restart, hotpatch months don't.

End-of-support dates come from Microsoft's 2027 lifecycle list. Microsoft can add extra baseline months for a single OS, so check Windows release health before each one.

The optional preview update has no fixed date. Microsoft says it typically lands in the fourth week of the month. Oracle sits a week after Microsoft, on the third Tuesday, so its next dates are 17 November and 15 December 2026.

What Each Monthly Release Includes

Windows gets four kinds of update in a month, and only one of them lands on Patch Tuesday. Microsoft laid out the model in a July 2026 servicing explainer, updated in October.

The monthly security update is Patch Tuesday itself. It's cumulative, and it carries the security fixes plus the non-security changes from the previous month's preview. It ships through Windows Update, WSUS and the Microsoft Update Catalog, and Microsoft's docs say organizations generally treat it as mandatory.

The optional non-security preview update arrives in the fourth week. It has no security fixes. It previews the non-security changes that roll into next month's security update. Microsoft now uses this name for what admins called the "C" or "D" release, though the old letters still turn up in some tools. Put it on your pilot ring and you see next month's changes a couple of weeks early.

The out-of-band (OOB) update ships outside the schedule when a security problem or a widespread bug can't wait. It's cumulative too. Critical OOB updates flow to WSUS and Windows Update automatically, while non-critical ones sit in the Update Catalog until somebody fetches them. The PrintNightmare fix is the textbook case: it shipped out of band on 6 July 2021, a week before that month's Patch Tuesday.

The hotpatch update installs security fixes without a restart on enrolled devices. A quarterly baseline update, which does need a restart, brings a device current on everything, and the next two months are hotpatch-only. Devices need virtualization-based security and the latest baseline to qualify, per Microsoft's hotpatch documentation.

Windows 10 is the other change to plan around. It left support on 14 October 2025, so its Patch Tuesday fixes now go only to PCs enrolled in Extended Security Updates. Organizations can buy ESU for up to three years. A Windows 10 PC without it still boots, but gets nothing on Patch Tuesday.

BrenTech walks through the same four release types in under five minutes:

A Patch Tuesday Rollout Plan for Week One

A fixed release day means you write the plan once and run it every month. The same rings work for a 50-person office and for an MSP with 40 clients. The MSP version sets rings per client and fits each one to that client's maintenance window.

Pick pilot users from every team, not only IT. If the finance team's add-in breaks, you want one finance user to find it on Wednesday, not the whole department on Friday.

How long to wait is the argument that never ends. In this January 2026 thread, answers ran from four rings spaced a day apart to a beta group on the third Tuesday and everyone else on the fourth:

When a fix is already being exploited, compress the plan. Pilot for hours, not a day, and push that one update to the broad ring as soon as the pilot is clean. CISA's three-day deadline for the October zero-day is a fair pace to copy.

Days 7 to 14 are the easiest step to skip. The laptop that was off all week and the server waiting on a reboot are the machines still exposed at the end of the month. Failed installs leave an error code to chase, such as error 0x80248007.

If the pilot finds a bad update, pause it instead of switching Windows Update off. Our guide to pausing Windows Update shows how to do it without breaking Defender's definitions.

If the update is already installed and breaking machines, our Windows update rollback guide covers Known Issue Rollback first, then uninstalling on one PC or across a fleet.

The last step closes the loop. A patch compliance report shows what's installed, what isn't and why, which is what an auditor or a client will ask for.

The rings live wherever you manage updates: Intune update rings or Windows Autopatch, an RMM's patch policies, or WSUS, which Microsoft has deprecated. Our WSUS explainer covers what that means for on-premises shops.

In OpenFrame, Mingo does the Day 0 read for you: it checks each update's known issues against the machine's role and the services running on it, and gives a hold-or-patch call per machine with the reason ($1 per device per month, with a 14-day free trial). Flamingo builds OpenFrame, which competes with some of the patching tools named in this guide.

How to Decide What to Patch First

Microsoft's MSRC puts it plainly: "For many customers, the priority is to install the appropriate security updates as soon as possible." Order still matters when a release carries more than a thousand CVEs and a pilot ring takes a day.

1. Start with CISA's Known Exploited Vulnerabilities catalog. A CVE on that list is being used in real attacks, and the federal due date shows how fast CISA thinks it should go.
2. Then the zero-days. The Security Update Guide flags each CVE as "Exploitation Detected" or "Publicly disclosed". Exploited goes first, and disclosed comes next because the details are already out.
3. Then Critical fixes on anything exposed: internet-facing RD Gateways, Exchange and SharePoint servers, DNS and DHCP servers, and the machines that open untrusted mail and documents.
4. Everything else rides the normal rings.

October's size split r/sysadmin. One team said it scrapped its rings and now pushes everything on day 1. Another admin said Microsoft now pulls and reissues a patch every few months. A priority order gives you both: speed where something is exploited, rings everywhere else.

Microsoft tried something new in October. The MSRC team grouped the release into 15 provisional risk cohorts: sets of CVEs that need the same question answered about your environment.

Take the "Remote-access and RDP deployments" cohort. Its question is which RDP clients, gateways and session hosts you run, and whether any are reachable from outside. Answer that once, and dozens of CVEs sort themselves. Microsoft is clear that cohorts are exploratory: they aren't official categories, the Security Update Guide doesn't show them, and each CVE still needs its own look.

For scoring beyond KEV and severity, such as EPSS, our vulnerability management software guide compares the tools that do it.

Is Patch Tuesday Just Microsoft?

No. SAP schedules its fixes for the same day, and Adobe and Fortinet shipped most of theirs on it in September and October 2026, so a security team's second Tuesday covers more than Windows. Oracle runs on a different Tuesday.

Adobe's security bulletin list shows the pattern: most of its September and October 2026 bulletins went out on 8 September and 13 October, the same days as Microsoft. A few extras landed off-cycle, so check the list each month.

FortiGuard's PSIRT advisory list shows the same two dates for most of Fortinet's advisories.

SAP says it chose the second Tuesday on purpose, to line up with other major vendors, on its Security Patch Day page.

Oracle's monthly track is new. The first Critical Security Patch Update shipped on 28 May 2026, and the quarterly Critical Patch Update continues, with the next one on 19 January 2027, per Oracle's security alerts page.

Browsers and most third-party apps follow none of these calendars. Chrome, Firefox and Edge ship security fixes on their own schedules, so they need their own policy in your patch tool.

Where to Read the Official Notes

Five sources cover everything Microsoft publishes, and each answers a different question.

The Security Update Guide lists every CVE in the release, with severity, affected products, KB numbers and the exploited and disclosed flags. Start here on Day 0.

Windows release health tracks known issues and workarounds for each Windows version. It's also in the Microsoft 365 admin center. Check it before the broad ring, and again before the stragglers.

The Windows message center carries the announcements: servicing changes, hotpatch notes and end-of-support reminders.

CISA's KEV catalog says what's being exploited and by when US federal agencies must fix it. It comes as a CSV and JSON feed, so your tools can read it too.

The Microsoft Update Catalog holds the packages themselves, for offline installs and for out-of-band updates that never reach Windows Update.

Intune and Defender Updates

Intune doesn't follow Patch Tuesday. Microsoft ships service changes through the month and logs them weekly in What's new in Intune, grouped into a monthly service release. Service release 2610 landed the week of 26 October 2026.

For what Intune covers as a patching tool, and where an RMM still fills gaps, see our Intune vs RMM review.

Defender Antivirus runs on two tracks. Platform updates (KB4052623) and engine updates ship monthly and in phases, per Microsoft's Defender update guide. Only the current version gets full support, and anything more than two versions back is unsupported. Security intelligence updates, the definitions, ship on their own separate track.

New Defender for Endpoint features show up in Microsoft's "What's new in Microsoft Defender for Endpoint" page. Each monthly post in this series carries that month's Intune service release and Defender versions.

Patch Tuesday Archive

Each monthly breakdown is added here after the release.

• November 2026: the Outlook zero-day rated Moderate, and which Critical fixes go first.
• October 2026: the record release, and how Mingo checks patches before they land.

Second Tuesday, 10:00 a.m. Pacific, every month through 2027. Put the dates in the team calendar, write the rings down once, and spend Day 0 reading instead of guessing. If you're still picking the tool that does the patching, start with our patch management software comparison.