Patch Tuesday to Exploit Wednesday: Your 24-hour checklist
At around 10am Pacific on the second Tuesday of every month, Microsoft publishes its security updates, and two groups start reading them at the same time: attackers and defenders. While the defenders work out what to deploy first, attackers compare the patched code with the unpatched version. That race is how the day following Patch Tuesday earned its name, Exploit Wednesday.
After a Patch Tuesday release, most of the day usually goes to the grind: matching CVEs to machines, building spreadsheets, and chasing deployment statuses. That leaves little time for the research that actually tells you what to patch first. ManageEngine’s Exploit Wednesday page takes that research off your plate, highlighting the top five vulnerabilities to patch first each month. The checklist we'll go over today starts from that top five and then shows how ManageEngine Patch Manager Plus handles the rest, so your time goes into data-backed decision-making.
What "done" looks like at 24 hours
By the end of the first day—or your next available window—your environment should be:
Assessed: You know exactly which updates apply to your environment.
Prioritized: Every relevant update sits in a bucket, ranked by real-world risk.
Piloted: Your highest-priority fixes have been tested on a representative group.
Protected: Anything that can’t be patched yet has a temporary safeguard.
Documented: Every outstanding item has an owner and a review date.
Tuesday: Find the updates that apply to you
Start with the top five
Check ManageEngine’s Exploit Wednesday page for this month’s five most exploitable vulnerabilities. Keep Microsoft’s Security Update Guide handy to confirm details such as an Exploitation More Likely rating.
Let your environment answer “what applies to us?”
Doing this manually means a spreadsheet with a row per CVE, product, affected system, and exposure. In Patch Manager Plus, your endpoints are scanned continuously and missing patches are mapped to the machines that need them. You see the affected systems per update without building the list yourself.
Don’t stop at Windows
Browsers, PDF readers, compression tools, and remote-access software are frequent entry points. Adobe and other vendors often publish fixes on the same day as Microsoft. Patch Manager Plus covers Windows, macOS, Linux, and hundreds of third-party applications from the same console, so they land in the same view rather than a separate workstream.
Filter by risk, not just severity
Rank exploitation status above severity. A zero-day vulnerability rated Important can matter more than an unexploited Critical. In Patch Manager Plus, you can filter missing patches by exploit status, patch availability, and severity, and zero-day or publicly disclosed vulnerabilities appear in their own view. That gives you the “what can’t wait” list within minutes of the release.
Tuesday evening: Decide what can't wait
Bucket | What belongs here |
Patch now | Actively exploited, or a Critical remote flaw on an internet-facing or business-critical system. |
Patch this week | Critical or Important with no known exploitation, plus at least one signal: rated Exploitation More Likely, publicly disclosed, exploitable remotely without authentication, or affecting servers or privileged workstations. |
Patch next cycle | None of the signals above, or anything that depends on broader change control. |
Needs investigation | Unclear exposure or compatibility. Assign an owner and a decision deadline. |
Anything from the top five that you run belongs in Patch now or Patch this week. For everything else, ask four questions:
Confirmed exploitation: Is it being used in attacks today?
Easy reach: Can it be exploited remotely, without logging in?
Exposure: Does it touch internet-facing systems, servers, VPN endpoints, or privileged workstations?
Impact: What happens to the business if this system is compromised?
Turn the buckets into groups and policies
Instead of tracking owners in a sheet, build custom groups for your critical servers, executive laptops, and general workstations. Then give each group its own deployment policy. Your Patch now updates can be pointed at high-exposure groups, while less critical patches are excluded from sensitive servers or deferred to their normal window.
Decline what you don’t want
If an update is known to conflict with a business application, decline it for the affected group so it can’t deploy by accident. Then put it in Needs investigation with a deadline.
Keep the "Needs investigation" category small
Resolve it within a day or two, and bring in your security lead, application owners, the service desk, or whoever approves emergency changes so no decision waits on one person.
Wednesday morning: Pilot, protect, and document
Pilot first
Create a test group that represents your environment: A mix of hardware, OS versions, server roles, and key line-of-business apps, plus a few users who will tell you quickly if something breaks. Patch Manager Plus’s test-and-approve workflow lets you deploy to that group first, then approve or decline based on the result. Approved patches can flow straight into your automated deployment tasks.
Define a clean pilot
Installs complete, reboots finish, critical apps still work, and your endpoint detection and response (EDR) tool and other security agents still run and report. Check for a ticket spike at the service desk. Know your back-out plan before you start.
Schedule deployments around people
Use deployment policies to set maintenance windows, install when applications aren’t in use, wake devices before deployment, and control reboot behavior. Devices that are off, roaming, or in a remote office still get covered.
Protect what you can’t patch yet
If a vendor fix isn’t available, or a system can’t take it today, apply a safeguard to buy time: restrict network access, isolate the system, disable the affected feature, apply the vendor’s documented workaround, or increase monitoring. For zero-day and publicly disclosed vulnerabilities, Patch Manager Plus can deploy mitigation workarounds from the same console, and it flags the vulnerability when the official patch arrives.
Record every exception as a decision someone owns
Name the system, the reason it can’t be patched, the safeguard in place, the owner, and a review date. “We always wait a month” and “it’s only an internal server” are habits, not reasons.
Wednesday afternoon: Expand, verify, and close the loop
Check for known issues
Review Microsoft’s Windows release health page for problems reported against this month’s updates before you widen the rollout.
Expand in phases
Start with the highest-risk groups and move outward once the pilot is healthy.
Verify instead of assuming
Confirm installs have completed: Check which machines are waiting on a reboot, review failed deployments, and rescan to confirm the patches now show as being installed. Patch Manager Plus’s compliance dashboards and reports show deployment status and remaining exposure in one place, and you can schedule them to run on their own.
Close the loop
Record what’s still outstanding, why, who owns it, and when it will be addressed. Anything left in Patch this week moves into your normal rollout plan.
The 24 hours at a glance
When | Manual approach | With Patch Manager Plus |
Tuesday | Read advisories, build a spreadsheet, and map CVEs to machines | Start from the top five, then filter missing patches by exploit status and see affected systems instantly. |
Tuesday evening | Sort updates into buckets by hand | Sort by risk, then apply group-based policies. |
Wednesday morning | Hand-pick pilot machines and script deployments | Test-and-approve workflow, scheduled deployment, and built-in mitigation for zero-day exploits. |
Wednesday afternoon | Chase status across machines and tools | Compliance dashboards and reports prove what’s patched and what isn’t. |
Whatever tooling you use, the sequence stays the same: Map first, prioritize by exploitation, perform a pilot, protect by deploying, verify actions, and document results. Automation just means the hours go to decisions rather than data entry, and every exposed system ends the day with either the fix it needs or an owner and a date for the remaining gap.
Bookmark the Exploit Wednesday page so the top five is your first stop next Patch Tuesday, and register for the free monthly Patch Tuesday webinar for the full breakdown.
Want to see how much of this checklist runs on its own in your environment? Start a free trial of Patch Manager Plus and run your first Patch Tuesday through it.