Exploit Wednesday: The blind spot in your Patch Tuesday routine

On Patch Tuesday in January 2023, Microsoft fixed a privilege escalation flaw in afd.sys, the Windows driver behind the Winsock networking interface. Two IBM X-Force researchers who had never worked with that driver compared the old and new versions of the file and had a working exploit for Windows 11 in about a day. China's 360 IceSword Lab later reported finding the same flaw already exploited in the wild that month.

The security community has a name for that race between attackers and defenders: Exploit Wednesday.

What is Exploit Wednesday?  

Microsoft has released its monthly security fixes on the second Tuesday of each month since October 2003. Exploit Wednesday is the day immediately after Patch Tuesday, and the name reflects how quickly attackers move once a fix is public. The term is security-community shorthand that IBM X-Force researchers describe as an old hacker adage.

As soon as a patch is published, security researchers and threat actors alike can compare the patched files against the unpatched versions, a technique known as patch diffing, to work out exactly what vulnerability was fixed and how. Anyone with the patched binary and the previous version can work backward from the changed code toward a proof of concept (PoC), a minimal exploit that shows the flaw can be triggered, and community indexes such as Winbindex make older versions of Windows binaries easy to download.

In many cases, that analysis moves faster than your own review and rollout cycle, and working exploit code can start circulating before you've applied the fix to your first batch of machines. The afd.sys case shows how little stands in the way: only one function had changed between the December 2022 and January 2023 versions of the driver, which the IBM researchers said sped up their analysis significantly.

Why the timing matters  

Even with good patching practices, you still need time to:

• Identify affected operating systems and applications.

• Determine which devices are missing the update.

• Assess the severity and exploitability of the vulnerability.

• Test the update for compatibility issues.

• Schedule deployment.

• Reach remote or offline devices.

• Confirm that installation was successful.

During this period, vulnerable systems remain exposed, and you are juggling several competing priorities at once. A single monthly release can fix dozens of vulnerabilities, or nearly 1,000 as in September 2026, across Windows, Office, Exchange, SQL Server, and other Microsoft products, some aimed at servers and others at user devices. Vendors such as Adobe publish their own fixes on the same day, which adds third-party applications to the same week's workload.

What changes after Patch Tuesday?  

Before the release, you are managing known vulnerabilities from threat intelligence, vendor advisories, scanner findings, and your existing risk assessments. After the release, the technical details become more concrete. The patch, affected files, release notes, and vulnerability information give researchers and threat actors a clearer view of what changed. A flaw you had never heard of on Monday, or one sitting at medium priority in your risk register, may need to be addressed on a higher priority by Wednesday.

Your normal Patch Tuesday process needs an additional layer of analysis at this point.

Exploitability signals that should move a patch up your queue  

A vulnerability's priority can shift within hours of the initial release, as researchers publish technical write-ups and PoC code or document the conditions an attacker needs.

You should monitor whether:

• Technical details have been published.

• A proof of concept has appeared.

• Exploitation has been reported in the wild.

• The flaw has been added to the Known Exploited Vulnerabilities (KEV) catalog maintained by the US Cybersecurity and Infrastructure Security Agency (CISA).

• Microsoft rates the flaw "Exploitation More Likely" in its Exploitability Index.

• Security researchers have demonstrated a practical attack path.

• The vulnerability affects systems that are exposed or widely deployed.

• New guidance recommends accelerating remediation.

A published PoC shows how the vulnerability could be abused, even while attacks remain unreported, and can justify moving the patch higher in your remediation queue.

Exploitability can outrank severity in your patch queue  

Your initial Patch Tuesday assessment was probably based mainly on vendor severity ratings and your asset inventory. After disclosure, you have additional information about exploitability and real-world exposure.

The new information can reorder your patch queue. For example, a vulnerability with a high severity rating may initially be scheduled for deployment during the next maintenance window. If researchers later demonstrate a reliable exploitation method, you may decide to accelerate the rollout, or apply a mitigation and step up monitoring until deployment is complete. Accelerating carries its own risk, since an update that skips your usual test group can break a line-of-business application, and the exploit evidence has to justify that trade.

Severity ratings alone can mislead you here. In September 2026, both exploited zero-days (flaws attackers were using before any fix existed) carried a Common Vulnerability Scoring System (CVSS) score of 7.8 and an Important rating, which placed them below more than 100 Critical flaws in the same release. A queue sorted by severity would have put the two flaws attackers were already using behind bugs with no reported exploitation.

Exploit Wednesday gives you the information to revisit those priorities inside the process you already run.

The endpoints where a missed patch costs the most  

Once you know how many endpoints are vulnerable, the next question is which of them creates the greatest exposure.

A vulnerable application on a widely used laptop may require a different response from the same application on a public-facing server or a system containing sensitive data. Your post-release assessment should account for:

• Internet-facing systems.

• Privileged administrator devices.

• Systems containing sensitive information.

• Widely deployed applications.

• Devices that cannot be quickly isolated or rebuilt.

• Endpoints that are frequently offline or difficult to reach.

• Assets that provide access to other parts of your environment.

Sorting endpoints into these groups lets you direct attention where a successful compromise could have the greatest consequences.

Exposure-window metrics that show where your process stalls  

Exploit Wednesday also highlights a useful operational metric: how long vulnerable systems remain exposed after a patch becomes available.

You may want to measure:

• Time from patch release to initial assessment.

• Time from assessment to approval.

• Time from approval to deployment.

• Time required to reach remote endpoints.

• Number of systems still unpatched after deployment.

• Time taken to remediate failed installations.

Tracked across a few release cycles, these numbers show where delays occur in your process. If most patches are approved quickly but remain undeployed on remote devices, for example, look at endpoint reachability, check-in frequency, user availability, and deployment configuration before you revisit how you prioritize.

Why risk outlasts the first deployment  

Risk persists after deployment starts, because some systems fail to install the update and others wait on a restart before the fix takes effect. The restart is often the step the business pushes back on hardest.

Continue monitoring for failed installations, devices that haven't checked in, systems running vulnerable versions, new exploitation reports, additional vendor guidance, and out-of-band updates (emergency fixes Microsoft ships outside the monthly cycle) or mitigation. Post-deployment monitoring matters most for vulnerabilities that receive public technical attention after the initial release.

Patch Tuesday and Exploit Wednesday, at a glance

Patch Tuesday starts the remediation workflow, and Exploit Wednesday feeds urgency and new information into the decisions that follow. On a lean IT team, the same person often is responsible for both.

Most of the exposure-window metrics above come down to two questions: which endpoints are still missing the patch, and why. A patching tool like Patch Manager Plus scans your endpoints for missing patches and shows deployment statuses for each system, so you can see which machines remain unpatched. It provides centralized patch visibility and supports patching across Windows, macOS, Linux, and more than 1,100 third-party applications. How quickly you deploy a given update remains your call, based on your own risk assessment and testing.