This is the Trace Id: e2b9dc8726fa895180bb9ef32b9b2e1a
Skip to main content
MSRC

Security Update Guide FAQs

 

  •  

    The Security Update Guide is the authoritative source of information for Microsoft security updates. The SUG helps IT professionals understand and use Microsoft security release information, processes, communications, and tools so they can manage organizational risk and develop a repeatable, effective deployment mechanism for security updates.

    Accessing the Security Update Guide data: You can customize your views and download affected software spreadsheets, as well as access data via a RESTful API.

    Security Update Guide tutorials: A series of Security Update API demo videos have been published on the Microsoft Support YouTube channel. The series will walk you through how to access the API and how to retrieve security update data using the API. 

     

  • Microsoft schedules the release of security updates on "Patch Tuesday," the second Tuesday of each month at 10:00 AM PST.

    Depending on time zone(s) in which the organization operates, IT pros should plan their deployment schedules accordingly. Please note that there are some products that do not follow the Patch Tuesday schedule.

  •  

    Yes! 

    Microsoft sends out a notification whenever there is material information that affects customers’ security. If security changes are required, Microsoft releases a security update which includes all of its supporting collateral such as the Security Update Guide and Knowledge Base article. Otherwise, Microsoft communicates via several methods (for example, a security advisory or a blog post) on the matter that affects customers’ security and provides guidance along the way.

    Microsoft Technical Security Notification Services

    Microsoft's free monthly Security Notification Service provides links to security-related software updates and notification of re-released security updates. You can choose between basic and comprehensive formats. These notifications are written for IT professionals, contain in-depth technical information, and are digitally-signed with PGP.

    Subscribe at https://www.microsoft.com/msrc/technical-security-notifications

    Microsoft Security Response Center (MSRC) blog alerts

    The MSRC blog provides a real-time way for the MSRC to communicate with IT pros. The MSRC uses this blog to disseminate important and material security communications to help IT pros understand Microsoft security response efforts; updates during the early stages of security incidents; and regular postings for the vulnerabilities release cycle: https://msrc-blog.microsoft.com/

    MSRC Twitter: @msftsecresponse

    MSRC uses a verified Twitter account to post brief notifications about security updates, security advisories and other security issues. Follow @msftsecresponse for fast access to the latest information.

     

  •  

    You can find the PGP key for security notifications here.

     

  • Unfortunately not. Our current system accepts only Microsoft accounts, which cannot be created with work or school emails.

  •  

    Microsoft subjects all security updates to extensive research, development, and testing processes, and released only when they meet an acceptable level of quality. As part of the risk assessment process, administrators often want to identify any known issues. Typically, these issues will be documented in Knowledge Base articles associated with the security updates at support.microsoft.com. These Knowledge Base articles accompany all security updates and advisories, and include caveats or known issues with security updates. Additionally, support engineers document common concerns from customers in these KB articles. 

    These Knowledge Base articles are published the Security Update Guide with each release on Patch Tuesday.

     

  •  

    Yes. Microsoft publishes localized security update release information on the Security Update Guide.

     

  • Yes. You can find acknowledgements in the CVE Detail sections of the Security Update Guide. You can also see a list of all Acknowledgements here: https://portal.msrc.microsoft.com/en-us/security-guidance/acknowledgments

  • Yes.

  • Microsoft has made the strategic decision to follow the CVRF Industry Standard for vulnerability reporting. You can learn more about CVRF and review the data schema at http://www.icasi.org/cvrf/

  • The Security Update Guide dashboard is available without logging in. If you click the Developer tab to access the API, you’ll be prompted to log in to your Microsoft account.

  •  

    Thanks! You can post suggestions on the MSRC Portal Support Form.

     

  • In the Security Update Guide, you can group related updates by combining the date filter with Product Category, Severity, and Impact filters. You can then download the results to CSV.

  •  

    To help customers understand the risk associated with each vulnerability, Microsoft provides the following data on the Security Update Guide:

    • Impact: security threats of the vulnerability.
    • Severity: Maximum potential impact of the attack.  See more at Security Update Severity Rating System
    • CVSS Score: Common Vulnerability Scoring System (CVSS)
    • Publicly Disclosed: Marked YES when the vulnerability has been publicly disclosed before the release of the security update.
    • Exploited: Marked YES when the vulnerability has been exploited before the release of the security update.
    • Microsoft Exploitability Index: Potential exploitability of each vulnerability of Important or Critical severity associated with a Microsoft security update. See more at Microsoft Exploitability Index

    Additional Microsoft resources to evaluate risk:

     

  •  

    Windows Update and Microsoft Update

    • Security Updates are generally categorized as Important and will be downloaded and installed automatically.

    Microsoft Update Catalog

    Windows Server Update Services (WSUS)

    Installation Logic: ​With automatic update technologies, detection and installation logic automatically manages the installation order of security updates. If you manually install security updates, please make sure to check the Security Update Guide and Knowledge Base article before installing.

    Patch compliance: Windows Update Agent (WUA) can be used to scan computers for security updates without connecting to Windows Update or to a Windows Server Update Services (WSUS) server, which enables computers that are not connected to the Internet to be scanned for security updates. For more info, see “Using WUA to Scan for Updates Offline”

    File size of security update: File size of each security update package is documented on the Windows Update catalog site.

    Servicing Models of Windows: Windows uses a rollup model to bring a more consistent and simplified servicing experience. Learn more about the servicing model of Windows at:

     

  •  

    Please see this guided walkthrough which provides steps to fix problems with Windows Update, such as taking a long time to scan or error codes while installing updates.

    Also, Windows Release Information publishes known issues on Windows.

     

  • The way Microsoft documents security updates has changed. The previous model used security bulletin webpages and included security bulletin ID numbers (e.g. MS16-XXX) as a pivot point. This form of security update documentation, including bulletin ID numbers, has been retired and replaced with the Security Update Guide. Instead of bulletin IDs, the new guide pivots on vulnerability ID numbers (CVE) and KB Article ID numbers.

  •  

    Updates will be supported for the duration of the product’s lifecycle. For more information about the support and servicing timeline for a specific product, please see the Lifecycle Product Database.

    Support end-day policy: In the event Microsoft releases a security update on the same day that a product is scheduled to end its lifecycle, security update supports will continue for a minimum of 30 days.

    Extended Security Updates: The Security Update Guide lists the vulnerabilities in the products with the Extended Security Updates. In order to receive the security updates, valid license for the Extended Security Updates is required. Please see the Extended Security Update FAQs for more information.