| 1 | --- |
| 2 | title: Patch Tuesday (Microsoft) |
| 3 | description: Patch-cycle view that prioritizes Microsoft CVEs by urgency (P0–P3), KEV, CVSS, and EPSS. |
| 4 | --- |
| 5 | |
| 6 | # Patch Tuesday (Microsoft) |
| 7 | |
| 8 | **Menu:** Agents → Patch Tuesday |
| 9 | |
| 10 | Patch Tuesday is a patch-cycle view focused on **Microsoft Patch Tuesday** releases. It helps you triage CVEs for a given patch cycle and prioritize what to patch first using: |
| 11 | - priority bands (**P0–P3**) |
| 12 | - **KEV** (Known Exploited Vulnerabilities) |
| 13 | - **CVSS** severity |
| 14 | - **EPSS** (exploit likelihood) |
| 15 | - affected product family / product |
| 16 | |
| 17 |  |
| 18 | |
| 19 | --- |
| 20 | |
| 21 | ## What you’re looking at |
| 22 | |
| 23 | ### Cycle summary |
| 24 | |
| 25 |  |
| 26 | |
| 27 | At the top, you’ll see: |
| 28 | - count of **unique CVEs** |
| 29 | - counts by priority (P0 Emergency, P1 High, P2 Medium, P3 Low) |
| 30 | - the patch cycle date and generation timestamp |
| 31 | |
| 32 | Use this for: |
| 33 | - a fast “how big is this month?” snapshot |
| 34 | - tracking backlog reduction over the patch window |
| 35 | |
| 36 | ### Filters |
| 37 | |
| 38 |  |
| 39 | |
| 40 | You can filter by: |
| 41 | - **Cycle** (e.g., `2026-Feb`) |
| 42 | - **Priority** |
| 43 | - **Product family** |
| 44 | - **Severity** |
| 45 | - **Search** (CVE, title, product) |
| 46 | |
| 47 | ### KEV toggle |
| 48 | |
| 49 |  |
| 50 | |
| 51 | Turn on **KEV** to focus on vulnerabilities that are known to be exploited. |
| 52 | |
| 53 | ### CVE cards |
| 54 | |
| 55 |  |
| 56 | |
| 57 | Each CVE entry typically includes: |
| 58 | - CVE ID + title |
| 59 | - priority (P0–P3) |
| 60 | - KEV indicator (when applicable) |
| 61 | - product family and affected products |
| 62 | - CVSS |
| 63 | - EPSS + percentile |
| 64 | - associated KBs / updates (when available) |
| 65 | |
| 66 | --- |
| 67 | |
| 68 | ## How to use this page (operator workflow) |
| 69 | |
| 70 | A practical monthly flow: |
| 71 | |
| 72 | 1) **Start with KEV + P0** |
| 73 | - Turn on KEV |
| 74 | - Filter to P0 (Emergency) |
| 75 | - Patch these first (or implement compensating controls immediately) |
| 76 | |
| 77 | 2) **Use EPSS to prioritize within a priority band** |
| 78 | - When you have many P1/P2 items, sort mentally by EPSS (higher likelihood first) |
| 79 | |
| 80 | 3) **Group work by product family** |
| 81 | - Cluster Windows Server vs Workstations vs Office/Edge/etc. |
| 82 | |
| 83 | 4) **Coordinate by customer / environment** |
| 84 | - In multi-tenant stacks, drive patch work per tenant and track completion |
| 85 | |
| 86 | 5) **Validate outcome** |
| 87 | - Confirm patch deployment via your patch tooling |
| 88 | - Re-check vulnerability posture in CoPilot after inventory refresh |
| 89 | |
| 90 | --- |
| 91 | |
| 92 | ## What P0–P3 means (recommended interpretation) |
| 93 | |
| 94 | Use the priority bands as an urgency rubric: |
| 95 | - **P0 (Emergency):** patch immediately (especially if KEV/high EPSS) |
| 96 | - **P1 (High):** patch in the first wave of the cycle |
| 97 | - **P2 (Medium):** patch in the standard window |
| 98 | - **P3 (Low):** patch as capacity allows |
| 99 | |
| 100 | Always combine this with: |
| 101 | - asset criticality |
| 102 | - exposure (internet-facing vs internal) |
| 103 | - compensating controls (EDR, network controls, app allowlisting) |
| 104 | |
| 105 | --- |
| 106 | |
| 107 | ## Prerequisites |
| 108 | |
| 109 | - Patch Tuesday feed/data source is enabled and up-to-date |
| 110 | - Vulnerability data ingestion is working (for EPSS/CVSS enrichment where applicable) |
| 111 | |
| 112 | --- |
| 113 | |
| 114 | ## Gotchas |
| 115 | |
| 116 | - Don’t treat CVSS as a patch order by itself—use KEV + EPSS + exposure + asset criticality. |
| 117 | - Patch Tuesday prioritization is about **urgency**, not just severity. |
| 118 | - Some environments require maintenance windows—use compensating controls when you can’t patch immediately. |