The Update BureauMost Windows updates follow a calendar: the security update on Patch Tuesday and an optional preview later in the month. Two kinds of update break that rhythm, and they call for different reactions.
Out-of-band (OOB): an emergency fix
An out-of-band update is released outside the monthly schedule because a problem cannot wait. It fixes a recently found issue or vulnerability. Microsoft's rules for OOB updates:
- They are always cumulative: they include earlier updates and replace the monthly and preview updates before them.
- A critical OOB update is offered automatically through Windows Update and WSUS, like a monthly update.
- A non-critical OOB update is available only from the Microsoft Update Catalog. You choose to get it.
A real example: on September 14, 2026 Microsoft released KB5129195 for Windows 11 24H2 and 25H2. It fixed Remote Desktop problems caused by the September security update, and also added a security fix.
What to do: read the update's page on this site or the KB article. If you have the problem it fixes, install it. If you don't, the next monthly update will include it anyway.
Exploited or publicly disclosed: install now
This is about vulnerabilities, not about how an update is delivered. In Microsoft's Security Update Guide, a vulnerability can be flagged:
- Exploited: attackers are already using it. Microsoft's Exploitability Index calls this "Exploitation Detected" and asks customers to treat the fix with the highest priority.
- Publicly disclosed: details were made public before a fix existed, so attackers can study them.
An update that fixes an exploited vulnerability can arrive in the monthly update or, rarely, as an OOB update. Either way there is no reason to wait for the optional preview, and you should not pause it.
Quick decision guide
On this site the verdict of an update follows the same logic:
| Situation | Verdict |
|---|---|
| Update fixes an Exploited vulnerability ("zero-day") | Install now |
| Regular security update, including one that fixes a Publicly disclosed vulnerability | Recommended: install it with your normal monthly routine, without delay |
| OOB update for a problem you have | Install it |
| OOB update for a problem you do not have | Wait for the monthly update |
For IT admins
Treat exploited vulnerabilities as an exception to your normal ring schedule: shorten deferrals for the affected products and check the calendar for the next release. Remember that a critical OOB update reaches WSUS and Windows Update policies automatically, while non-critical ones must be imported from the Catalog. Follow open problems in known issues and browse every release in updates.
Sources
Edited by the site editor. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake