Pending OS Patches
The Pending OS Patches module consolidates all missing or pending operating system patches into a single screen. This is an excellent place to check and verify that OS patches are being installed as expected. Any pending OS patches missing from an active asset will be indicated as a vulnerability. You can use the Patch Management module to install a missing OS patch.
These are standalone packages that already include all fixes from previous releases, which means earlier updates do not need to be installed as prerequisites.
We always surface the latest applicable cumulative update so that all known vulnerabilities addressed by Microsoft are fully remediated and properly reflected as resolved. Showing only the most recent update helps prevent partial patch states and ensures the system aligns with Microsoft’s current security baseline.
This is why a newer cumulative update appears as applicable even if earlier updates are not present.
- Security < Continuous Threat Exposure Management < 'Pending OS Patches'
Access the Pending OS Patches from the Assets category.
The table data displays the details of the missing patches.
Tap on the ‘Knowledge Base KB’ info to see the details of the pending patch.
The optional ‘Number of days' filter allows you to set a value between 0 and 60. This filter is based on the number of days since the patch was released.
| Note: CTEM reports only missing security patches that map to CVEs. Non‑security Windows updates e.g. Defender platform updates or KBs without CVE associations are not included.If only non‑security updates are pending, CTEM will correctly show “0 patches missing.” |