Patch Tuesday dates for 2026 and 2027, plus other vendor patch days

The next Microsoft Patch Tuesday is Tuesday, October 13, 2026, followed by November 10 and December 8. In 2027, Patch Tuesday falls on January 12, February 9, March 9, April 13, May 11, June 8, July 13, August 10, September 14, October 12, November 9 and December 14. Microsoft releases its monthly security update on the second Tuesday of every month, typically at 10:00 a.m. Pacific Time.

Several other vendors and open source projects also publish security fixes on fixed days. The dates below come from each vendor's official schedule as of October 2026. Where a vendor lists only its next few dates, later ones are calculated from its published rule and marked as such.

Microsoft Patch Tuesday dates

Remaining 2026 dates

• October 13, 2026
• November 10, 2026
• December 8, 2026

Patch Tuesday dates for 2027

• January 12, 2027
• February 9, 2027
• March 9, 2027
• April 13, 2027
• May 11, 2027
• June 8, 2027
• July 13, 2027
• August 10, 2027
• September 14, 2027
• October 12, 2027
• November 9, 2027
• December 14, 2027

According to Microsoft's Windows update release cycle documentation, the monthly security update is cumulative and is typically published at 10:00 a.m. Pacific Time. That is 17:00 UTC while US daylight saving time is in effect (mid-March to early November) and 18:00 UTC the rest of the year, so the October 13 release lands at 17:00 UTC and the November 10 and December 8 releases at 18:00 UTC. Microsoft also calls it Update Tuesday or the "B week" release.

Two other Windows release types sit around it:

• Optional non-security preview updates arrive in the fourth week of the month. They carry non-security fixes that then ship in the next Patch Tuesday, so admins can validate them early.
• Out-of-band updates are released as needed to resolve a recently identified issue or vulnerability.

Patch Tuesdays that end support

Microsoft's lifecycle dates line up with Patch Tuesday, so some of these releases are the last regular ones for a product:

• October 13, 2026: last update for Windows 11 version 24H2 Home and Pro, and the end of mainstream support for Windows Server 2022, which stays in extended support until October 2031.
• January 12, 2027: end of extended support for Windows Server 2016.
• October 12, 2027: last update for Windows 11 version 25H2 Home and Pro.

SAP Security Patch Day

SAP publishes its security notes on the second Tuesday of every month, a date SAP says it synchronized with the patch days of other major software vendors. SAP Patch Days therefore fall on the same dates as Microsoft's: October 13, November 10 and December 8, 2026, then the 2027 dates listed above.

Oracle Critical Patch Updates and Critical Security Patch Updates

Oracle now runs two schedules, both on the third Tuesday of the month, according to its security alerts page. Both are available to customers with valid support contracts.

Quarterly Critical Patch Updates (CPU)

Released on the third Tuesday of January, April, July and October. Oracle lists these next dates:

• October 20, 2026
• January 19, 2027
• April 20, 2027
• July 20, 2027

By the same rule, the October 2027 CPU would fall on October 19, 2027. Oracle publishes a pre-release announcement on the Thursday before each CPU.

Monthly Critical Security Patch Updates (CSPU)

Introduced in 2026, these are smaller packages of targeted, high-priority fixes that complement the quarterly CPUs. The first one was released on May 28, 2026. They are scheduled for the third Tuesday of February, March, May, June, August, September, November and December. Oracle's listed dates:

• November 17, 2026
• December 15, 2026
• February 16, 2027
• March 16, 2027

Applying Oracle's stated rule, the remaining 2027 CSPU dates would be May 18, June 15, August 17, September 21, November 16 and December 21. Together, the two schedules mean Oracle now ships a planned security release every month, exactly one week after Patch Tuesday. Fixes considered too urgent to wait still go out as separate Security Alerts.

Cisco bundled security advisories

Cisco generally publishes advisories at 16:00 GMT on any Wednesday, but its security vulnerability policy sets twice-yearly bundles for three product families:

• FXOS and NX-OS: fourth Wednesday of February and August, which in 2027 means February 24 and August 25.
• IOS XR: second Wednesday of March and September, which in 2027 means March 10 and September 8.
• IOS and IOS XE: fourth Wednesday of March and September, which in 2027 means March 24 and September 22.

The 2027 dates are calculated from Cisco's rule. Cisco reserves the right to publish outside these windows, for example when it learns that a vulnerability is being actively exploited or public awareness of a serious flaw rises.

Kubernetes monthly patch releases

The Kubernetes project ships patch releases for its supported minor versions roughly once a month. Its patch release page lists these target dates, with cherry-pick deadlines a few days earlier:

• October 13, 2026 (cherry-pick deadline October 9)
• November 10, 2026 (cherry-pick deadline November 6)
• December 15, 2026 (cherry-pick deadline December 11)
• January 12, 2027 (cherry-pick deadline January 8)

Critical fixes can ship outside this cadence. Kubernetes 1.34 reaches end of life on October 27, 2026, after which the supported branches are 1.35, 1.36 and 1.37. Platform release news is collected in our DevOps platforms section.

How to plan maintenance around the calendar

• Group your test cycles. Microsoft and SAP always share a day, and in October, November and January the Kubernetes target date falls on Patch Tuesday too. Oracle follows exactly one week later, so a two-week window after each Patch Tuesday covers most scheduled releases.
• Leave room for out-of-band fixes. Fixed schedules cover planned releases only. Actively exploited flaws often get emergency patches, and CISA can add them to its Known Exploited Vulnerabilities catalog with short deadlines for federal agencies.
• Track end-of-support dates. A product that has passed its final Patch Tuesday stops receiving security updates through the normal channel, so plan upgrades before October 13, 2026 and January 12, 2027 if they affect you.
• Subscribe at the source. Microsoft's Security Update Guide, SAP's support portal, Oracle's security alert notifications and Cisco's PSIRT publications are the primary sources for each release.

The most serious fixes from each patch day are covered in our vulnerabilities section.

Frequently asked questions

When is the next Patch Tuesday?

The next Patch Tuesday is October 13, 2026. The following ones are November 10 and December 8, 2026, and January 12, 2027.

What time are Patch Tuesday updates released?

Microsoft typically publishes them at 10:00 a.m. Pacific Time. That is 17:00 UTC during US daylight saving time and 18:00 UTC otherwise.

Is Patch Tuesday always the second Tuesday of the month?

Yes. Microsoft defines the monthly security update as released on the second Tuesday of each month, so it always falls between the 8th and the 14th.

When is the next Oracle Critical Patch Update?

The next quarterly Critical Patch Update is on October 20, 2026, followed by January 19, 2027. Oracle's smaller monthly Critical Security Patch Update is next due on November 17, 2026.

Is SAP Patch Day the same as Patch Tuesday?

Yes. SAP Security Patch Day is the second Tuesday of every month, the same day Microsoft releases its monthly security updates.