Security Bulletins

  • Article

The Microsoft Security Response Center releases security bulletins on a monthly basis addressing security vulnerabilities in Microsoft software, describing their remediation, and providing links to the applicable updates for affected software. Each security bulletin is accompanied by one or more unique Knowledge Base Articles to provide further information about the updates.

For more information or to search for a security bulletin, see Bulletin Search.

Stay Up to Date

  • Help protect your computing environment by keeping up to date on Microsoft technical security notifications. For more information, see Microsoft Technical Security Notifications.

  • Enable automatic updates. Most customers have automatic updating enabled and will not need to take any action because the security updates will be downloaded and installed automatically. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871. For customers who do not have automatic updating enabled, the steps in Turn automatic updating on or off can be used to enable automatic updating.

    For enterprise installations, or administrators and end users who want to install security updates manually (including customers who have not enabled automatic updating), Microsoft recommends that customers apply critical updates immediately by using update management software, or by checking for updates using the Microsoft Update service. The updates are also available via the download links in the Affected Software table in the individual bulletins.

  • It should be a priority for customers who have older releases of the software to migrate to supported releases to prevent potential exposure to vulnerabilities. To determine the support lifecycle for your software release, see Select a Product for Lifecycle Information. For more information about service packs for these software releases, see Service Pack Lifecycle Support Policy.

    Customers who require custom support for older software must contact their Microsoft account team representative, their Technical Account Manager, or the appropriate Microsoft partner representative for custom support options. Customers without an Alliance, Premier, or Authorized Contract can contact their local Microsoft sales office. For contact information, see the Microsoft Worldwide Information website, select the country in the Contact Information list, and then click Go to see a list of telephone numbers. When you call, ask to speak with the local Premier Support sales manager. For more information, see the Microsoft Support Lifecycle Policy FAQ.

Detection and Deployment Tools and Guidance

Several resources are available to help administrators deploy security updates. 

  • Microsoft Baseline Security Analyzer (MBSA) lets administrators scan local and remote systems for missing security updates and common security misconfigurations. 
  • Windows Server Update Services (WSUS), Systems Management Server (SMS), and System Center Configuration Manager help administrators distribute security updates. 
  • The Update Compatibility Evaluator components included with Application Compatibility Toolkit aid in streamlining the testing and validation of Windows updates against installed applications. 
  • Vulnerabilities described in the security bulletins affect Server Core installations of supported editions of Windows where indicated in the Affected Software tables. For more information, see Managing a Server Core Installation: Overview, Servicing a Server Core Installation, and Server Core and Full Server Integration Overview.

For information about these and other tools that are available, see Security Tools for IT Pros.

Obtain help and support for security updates

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please go to the active protections websites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.