Patch Tuesday

Patch Tuesday is the second Tuesday of the month — and a fixed date on the calendar for IT departments worldwide. On this day, Microsoft releases, all at once, all the security updates that have accumulated since the last time. An update that closes a security vulnerability is called a patch — like a piece of fabric sewn onto a torn spot. Instead of releasing such patches irregularly, Microsoft bundles them into a fixed day. This makes it easier to plan and roll them out. Microsoft introduced this rhythm in 2003, after chaotically distributed updates had unnecessarily complicated the work of system administrators — that is, the people who manage computers in companies.

Why a fixed date changed IT security

Before Patch Tuesday, there was no way to predict when an update would appear. For companies, this was a problem: every update had to be checked, tested, and distributed to thousands of devices immediately — without warning, at any time. This constantly tied up staff and disrupted ongoing operations.

A fixed date solves this. IT teams know in advance when work will come their way and can prepare accordingly. They can try out updates on test devices first before rolling them out to all company computers. This sounds like a minor advantage, but in practice it is enormous — especially in hospitals, government agencies, or banks, where a faulty update can bring operations to a standstill.

At the same time, the fixed rhythm has a downside: anyone who knows about a security vulnerability knows that Microsoft will close it at the earliest on the next Patch Tuesday — unless it is so dangerous that an emergency update becomes necessary. This gap between discovery and closure is called the attack window. Attackers can exploit it specifically.

What actually happens on a Patch Tuesday

Microsoft doesn’t simply publish files for download. Along with the updates comes a so-called Security Update Guide — a list of all the vulnerabilities closed, with technical details. Each vulnerability gets its own identification number, the so-called CVE number (Common Vulnerabilities and Exposures). Security researchers and attackers read this list carefully, as it shows exactly where something was previously broken.

Each Patch Tuesday typically closes between 50 and 150 security vulnerabilities. Some are harmless and affect hardly anyone. Others are classified as “critical” — meaning an attacker could exploit them remotely without the user having to do anything. For IT teams, this classification is crucial: critical updates are rolled out first.

If a vulnerability is so severe that it cannot wait until the next regular date, Microsoft also releases updates outside the normal schedule. This is referred to as an out-of-band patch. This is the exception — but it does happen, for example when a vulnerability is already being actively exploited by attackers before an official fix exists.

Patch Tuesday in the news and everyday life

The term appears in tech media every month. Typical headlines read: “Patch Tuesday closes critical zero-day vulnerability in Windows” — where zero-day refers to a vulnerability that attackers had already exploited before Microsoft even knew about it. Anyone reading such news understands it better knowing that there’s no coincidence behind the date, but a system.

For ordinary Windows users, Patch Tuesday usually goes by unnoticed. Windows Update automatically downloads the patches, and they are installed at the next restart. The message “Installing updates, please don’t turn off your computer” — almost everyone knows it. It appears especially often on the second Wednesday of the month, because Windows downloads the updates provided on Tuesday overnight.

Meanwhile, other vendors have also aligned themselves with this rhythm. Adobe, SAP, and Intel likewise prefer to release their security updates on the second Tuesday of the month — not because they have to, but because IT teams are already scheduling updates on that day anyway. Patch Tuesday has thus evolved from an internal Microsoft process into an industry-wide pacesetter.