How do I get security updates for Windows XP?

Windows XP is out of support, so regular security updates are no longer provided. Only a few exceptional, one‑off security updates have been released since end of support, and Microsoft recommends migrating to a supported Windows version instead of trying to keep XP secure.

Key points from the available guidance:

1. End of support and normal updates
   • Support for Windows XP ended on April 8, 2014. After this date there are no new security updates, non‑security hotfixes, free or paid assisted support options, or online technical content updates for XP.
   • Microsoft explicitly states that PCs running Windows XP should not be considered to be truly protected, even if antimalware signatures are still updated.
2. Antimalware vs. OS security updates
   • Microsoft continued to provide antimalware signatures and engine updates for Windows XP only through July 14, 2015 for products like Microsoft Security Essentials and System Center Endpoint Protection.
   • These antimalware updates help detect and block some malware, but do not fix the underlying OS vulnerabilities, because XP itself no longer receives security patches. A new strain of malware targeting the same unpatched vulnerability may bypass protection.
   • Microsoft notes that antimalware products have limited effectiveness on a PC which is not up‑to‑date with all the security updates.
3. Exceptional, one‑off security updates for XP
   • In rare cases, Microsoft has released special security updates for XP and other retired platforms when the risk was considered very high. Examples include:
     • Security advisory 4025685 (June 13, 2017) with guidance and manual download information for older platforms including Windows XP.
     • The CVE‑2019‑0708 (BlueKeep) Remote Desktop Services vulnerability, where Microsoft provided a KB4500331 security update for Windows XP SP3, XP Professional x64, and XP Embedded. These updates are available only from the Microsoft Update Catalog.
   • These are exceptions and do not represent a return to regular patching. Microsoft explicitly states that this should not be interpreted as a change in policy and again encourages upgrading to a supported platform.
4. How to get the few available XP security updates
   For the rare updates that were released for XP after end of support:
   • Use the Microsoft Update Catalog to search for the relevant KB numbers (for example, KB4500331 for CVE‑2019‑0708).
   • For older, still‑supported times (before 2014), XP updates could be obtained via Windows Update or manually via the Microsoft Download Center, but this is historical and not an ongoing update channel.
5. Security posture of an XP VM
   • Even with antimalware installed inside the XP VM, the OS remains permanently vulnerable because its core components are no longer patched.
   • Microsoft’s guidance is that customers should migrate to a supported operating system to receive regular security updates.
   • Running XP only in a VM with snapshots reduces risk but does not eliminate it; Microsoft’s documentation focuses on migration rather than trying to harden XP.
6. About using third‑party antimalware (e.g., Malwarebytes)
   • The provided context only covers Microsoft antimalware (Microsoft Security Essentials, System Center Endpoint Protection, etc.) and does not mention Malwarebytes or its versions.
   • From the available information, the only supported statement is that antimalware alone cannot compensate for missing OS security updates on XP.

In summary, there is no supported way to get ongoing, comprehensive security updates for Windows XP. Only a few exceptional patches (such as for CVE‑2019‑0708) are available via the Microsoft Update Catalog, and Microsoft’s official guidance is to treat XP as not truly protected and to upgrade to a supported Windows version.

References:

• Microsoft antimalware support for Windows XP
• How to download a Windows update manually
• Microsoft security advisory 4025685: Guidance for older platforms: June 13, 2017
• Microsoft Security Bulletin MS05-007 - Important
• Customer guidance for CVE-2019-0708 | Remote Desktop Services Remote Code Execution Vulnerability: May 14, 2019
• Security updates are available on ISO-9660 DVD5 image files from the Microsoft Download Center