|
Each week, the CMS Hybrid Cloud program provides a list of upcoming changes, maintenance windows, and updates to help customers build awareness and plan effectively and summarizes changes from the previous week.
This newsletter includes:
Completed change summary for the week of 9/10/2026
- 9/10/2026 - Splunk DC - Amazon Linux OS Patching
- 9/11/2026 - Patch Splunk to version 10.2.7 - Splunk DC/ADC/KDC environments
- 9/11/2026 - Patch Splunk to version 10.2.7 - Cloud Splunk Prod, OC, Splunk DC environments
- 9/11/2026 - Patch Splunk to version 10.2.7 - MAG & OBH environments
- 9/11/2026 - Enterprise JIRA Maintenance
- 9/16/2026 - Non-marketplace SSM Patching - DEV/TEST/IMPL
- 9/16/2026 - Azure Commercial - Azure Update Manager Patching - DEV/TEST/IMPL
- 9/16/2026 - AWS Outpost SSM Patching - DEV/TEST/IMPL
- 9/16/2026 - MAG - Azure Update Manager Patching - DEV/TEST/IMPL
- 9/16/2026 - Marketplace SSM Patching - DEV/TEST
- 9/16/2026 - GCP- VM Manager Patching - DEV/TEST/IMPL
To learn details about previous changes please go to the News and Updates section on cloud.cms.gov. (Secure Access required)
For Patching and Gold Image release schedule please view: Patching and Gold Image Release Calendar - 2026
CMS Artifactory S3 Migration
On Saturday, September 26, 2026, 9:00 AM - Sunday, September 27, 2026, 7:00 PM,
CMS will migrate the production Artifactory S3 binary store from Client-Side Encryption (CSE) to Server-Side Encryption with KMS (SSE-KMS). During this time, CMS Cloud will migrate the production Artifactory S3 binary store and perform automated post-migration verification
For more information, visit cloud.cms.gov Artifactory Migration.
Impact: This migration impacts any platform that pulls from or pushes to the production Artifactory (artifactory.cloud.cms.gov), including Jenkins/CloudBees, GitHub Actions, GitLab CI, Azure DevOps, Local developer builds will be unavailable during the migration window. Teams should treat this window as a hard outage.
Non-Production (Dev) Builds will not be impacted.
Need Help?
If you experience Artifactory access, artifact push/pull, or build issues after the migration, contact our support team via:
9/17/2026 - Install Java 21 on Splunk ITSI servers
Summary:
Splunk logging team will install Amazon Corretto Java 21 on the Splunk ITSI Search Head Cluster members and configure the systems to use Java 21 in preparation for the Splunk ITSI 5.0.1 upgrade.
Actions we are taking:
Splunk ITSI 5.0.1 Java runtime Java 21 will be installed and configured before the ITSI 5.0.1 upgrade.
When is this happening?
Start Time: Thursday, 9/17/2026 at 9:00 p.m. ET
End Time: Thursday, 9/17/2026 at 12:00 a.m. ET
Who will be impacted?
ITOPS ITSI Splunk servers.
What is the impact?
No User impact expected as this to install java with no restarts.
9/20/2026 - Patch Splunk to version 10.2.7 - Splunk ADC/KDC
Summary:
The CMS Hybrid Cloud logging services team will perform maintenance patching to update Splunk enterprise to version 10.2.7 in ADC/KDC.
Actions we are taking:
- ADC Splunk prod environment
- KDC prod environment
- Splunk version update
When is this happening?
Start Time: Sunday, 9/20/2026 at 12:00 p.m. ET
End Time: Sunday, 9/20/2026 at 5:00 p.m. ET
Who will be impacted?
Users of the Splunk tool may experience brief periods where search performance is slow or degraded while servers are being restarted after the patch is applied.
9/23/2026 - Marketplace SSM Patching - IMPL
Summary:
As part of our normal patching, the CMS Hybrid Cloud team will apply the latest Windows and Linux patches on Wednesday, 9/23/2026 at 9:00 p.m. ET. The week's patches will impact the IMPL environment for the affected Marketplace applications noted below.
Actions we are taking:
- Marketplace IMPL
- SSM Linux & Windows Vulnerability Patching
When is this happening?
Start Time: Wednesday, 9/23/2026 at 9:00 p.m. ET
End Time: Thursday, 9/24/2026 at 2:00 a.m. ET
Who will be impacted?
FFM_Opera, VAMS, TWS, XES - XOC Tools, SERVIS, FFM_Shared_Services, FFM MLMS, XES - MSI Tech Lab, FFM_FM, FFM_TWS, XES - Service Virtualization
DSRS, FFM, FFM DSH, FFM EDI, FFM EFT, FFM ESDCU, MCR, FLH, OC Base- FLH, OC Base PET, FFM_MNPS, CMS Cloud - Advanced Monitoring
What is the impact?
Patches will be applied to the affected systems. For some customers, reboots may occur depending upon the tags applied.
9/23/2026 - MAG - Azure Update Manager Patching - PROD
Summary:
As part of our normal patching, the CMS Hybrid Cloud team will apply the latest Windows and Linux patches on Wednesday, 9/23/2026 at 9:00 p.m. ET. The week's patches will impact the PROD environment for Azure.
Actions we are taking:
- MAG Prod
- MAG Linux & Windows Vulnerability Patching
When is this happening?
Start Time: Wednesday, 9/23/2026 at 9:00 p.m. ET
End Time: Thursday, 9/24/2026 at 2:00 a.m. ET
Who will be impacted?
Subscriptions:
CMS.VDC-CCS.IUSG.SharedServices.001.AG
ScopeInfoTech-CM-HEDIS PLD-005
Resource Groups with Reboot:
RG-SS-LDAP-PROXY-PROD
rg-splunk-prod
NoReboot:
RG-AZE-HEDISPLD-PROD
What is the impact?
Patches will be applied to the affected systems. For some customers, reboots may occur depending upon the tags applied.
9/23/2026 - GCP - VM Manager Patching - PROD
Summary:
As part of our normal patching, the CMS Hybrid Cloud team will apply the latest Windows and Linux patches on Wednesday, 9/23/2026 at 9:00 p.m. ET. The week's patches will impact the PROD environment for the affected GCP applications noted below.
Actions we are taking:
- GCP PROD
- GCP Linux & Windows Vulnerability Patching
When is this happening?
Start Time: Wednesday, 9/23/2026 at 9:00 p.m. ET
End Time: Thursday, 9/24/2026 at 2:00 a.m. ET
Who will be impacted?
cms-cpt-workload1
FinOps-Tooling
gcp-cms-iusg-match-nonprod
gcp-cms-iusg-smtp-nonprod
gcp-cms-iusg-sharedvpc-prod
gcp-cms-iusg-security-nonprod
gcp-cms-iusg-ccsm-sandbox
gcp-cms-iusg-c4-nonprod
gcp-cms-iusg-helix-prod
gcp-cms-iusg-smtp-prod
gcp-cms-iusg-connectivity-prod
gcp-cms-iusg-sharedvpc-nonprod
gcp-cms-eadg-kmp-nonprod
gcp-cms-iusg-security-prod
gcp-cms-iusg-logging-nonprod
gcp-cms-iusg-goldimage-nonprod
gcp-cms-eadg-kmp-prod
gcp-cms-qmvig-eqrs-pa-nonprod
gcp-cms-iusg-logging-prod
gcp-cms-iusg-bigfix-prod
gcp-cms-iusg-goldimage-prod
gcp-cms-iusg-dprotect-nonprod
gcp-cms-iusg-infoblox-prod
gcp-cms-iusg-ad-prod
gcp-cms-iusg-dprotect-prod
gcp-cms-iusg-zscaler-prod
gcp-cms-iusg-patching-prod
gcp-cms-iusg-match-prod
gcp-cms-qmvig-eqrs-sf-nonprod
Master-Billing-Export
What is the impact?
Patches will be applied to the affected systems. For some customers, reboots may occur depending upon the tags applied.
9/23/2026 - Azure Commercial - Azure Update Manager Patching - PROD
Summary:
As part of our normal patching, the CMS Hybrid Cloud team will apply the latest Windows and Linux patches on Wednesday, 9/23/2026 at 6:00 p.m. ET. The week's patches will impact the PROD environment for the affected Azure commercial applications noted below.
Actions we are taking:
- Azure Commercial PROD
- Azure Commercial Linux & Windows Vulnerability Patching
When is this happening?
Start Time: Wednesday, 9/23/2026 at 9:00 p.m. ET
End Time: Thursday, 9/24/2026 at 2:00 a.m. ET
Who will be impacted?
Subscription:
azure-comm-ea-cms-iusg-gss-patching-prod
azure-comm-ea-cms-iusg-gss-goldimage-prod
azure-comm-ea-cms-iusg-gss-smtp-nonprod
azure-comm-ea-cms-iusg-gss-smtp-prod
azure-comm-ea-cms-iusg-gss-vdi-nonprod
azure-comm-ea-cms-iusg-gss-vdi-prod
azure-comm-ea-cms-iusg-gss-securitycomp-prod
azure-comm-ea-cms-iusg-gss-logging-nonprod
azure-comm-ea-cms-iusg-gss-logging-prod
azure-comm-ea-cms-iusg-gss-nerdio-prod
azure-comm-ea-cms-iusg-gss-security-prod
azure-comm-ea-cms-iusg-gss-security-nonprod
azure-comm-ea-cms-iusg-gss-identity-prod
azure-comm-ea-cms-iusg-gss-securityauto-prod
azure-comm-ea-cms-iusg-gss-bigfix-prod
azure-comm-ea-cms-iusg-gss-connectivity-prod
azure-comm-ea-cms-iusg-gss-dataprotect-dev
azure-comm-ea-cms-iusg-gss-zscaler-prod
azure-comm-ea-cms-iusg-gss-dataprotect-prod
azure-comm-ea-cms-iusg-gss-dataprotect-test
azure-comm-ea-cms-iusg-gss-infoblox-prod
azure-comm-ea-cms-iusg-gss-c4testing1-dev
azure-comm-ea-cms-iusg-gss-ccgchatbot-dev
azure-comm-ea-cms-iusg-gss-ccgchatbot-test
azure-comm-ea-cms-iusg-gss-finops-prod
azure-comm-ea-cms-iusg-iam-workloads-prod
What is the impact?
Patches will be applied to the affected systems. For some customers, reboots may occur depending upon the tags applied.
9/23/2026 - AWS Outpost SSM Patching - PROD
Summary:
As part of our normal patching, the CMS Hybrid Cloud team will apply the latest Windows and Linux patches on Wednesday, 9/23/2026 at 9:00 p.m. ET. The week's patches will impact the PROD environment for the affected Outpost applications noted below.
Actions we are taking:
- AWS Outpost PROD
- SSM Linux & Windows Vulnerability Patching
When is this happening?
Start Time: Wednesday, 9/23/2026 at 9:00 p.m. ET
End Time: Thursday, 9/24/2026 at 2:00 a.m. ET
Who will be impacted?
IDM, ECISWebservers-Outposts, AGX - Outpost, FM Interact/FM Systems, SWIFT - Outposts, Druva-Outposts, LaserFiche RIO, Bitlocker-Outposts, Warehouse Librarian, EUA/EFI-Outposts,ETC - Outposts, PhishMe(Cofense-Triage)-Outposts
What is the impact?
Patches will be applied to the affected systems. For some customers, reboots may occur depending upon the tags applied.
9/23/2026 - Non-marketplace PROD SSM Patching
Summary:
As part of our normal patching, the CMS Hybrid Cloud team will apply the latest Windows and Linux patches on Wednesday, 9/23/2026 at 9:00 p.m. ET. The week's patches will impact the PROD environment for the affected Non-marketplace applications noted below.
Actions we are taking:
- Non-marketplace PROD
- SSM Linux & Windows Vulnerability Patching
When is this happening?
Start Time: Wednesday, 9/23/2026 at 9:00 p.m. ET
End Time: Thursday, 9/24/2026 at 2:00 a.m. ET
Who will be impacted?
Reboot - CEDAR, FFSDCS, RASS, OC Base- eLDAP, SC CLIA, NTP LMS, Spott MACBIS, OC Base- WNMG, NEIL/HRES, OC Base- EWST, MacFin, eAPD Hi-C, OC Base- CMS Cloud Legacy, OC Base- DevSecOps SecDevOps, iServ, MDP, PECOS2.0, SEI, OC Base- PWSS, TRA, CMS ARTS, MCIM, RAD Analysis Tools, MCIM, Perm, CMS Cloud - CRE, CMS Cloud - Enterprise Agile Tools, CMS Cloud tamer, CMS Cloud - CARD, CMS Cloud - ECS Fargate, CMS Cloud - Direct Connect, CMS Cloud - Jfrog SonarCube, CMS Cloud - DNS Prod, CMS Cloud - Governance 2.0, MEOWx, CMS Cloud - CloudBees Jenkins, CMS Cloud - CET, CMS Cloud - DevSecOps, CMS Cloud - Utilities, CMS Cloud - Testrail, CMS Cloud - CircleCI, CMS Cloud - Sam GSS Security GovCloud, SWIFT, AWS HEIDI, MDX, MSPSC, QMAC, ESS-TOOLS, QCOR
No reboot - MEPBS, EACMS, MacPro, PS&R, RDS, OC Base- APIM GEO, 1115 PMDA, CMS Cloud - Governance 2.0, CMS Cloud - QuickDNS, CMS Cloud - CMSNet, CMS Cloud - CCG Web Content, CMS Cloud - Network Arch, CMS Cloud - VPC Automation, CMS Cloud - Security Team, CMS Cloud - CCG Web Content, CMS Cloud Temporal, CMS Cloud - Splunk, CMS Cloud - CET, AWS GSS Security GC, occonfluence, ocjira, miniorange, ocsonarqube, MTF-PM, NDW, MacFin, MTF-DM, PECOS-OM, NGD, EFT Cloud
What is the impact?
Patches will be applied to the affected systems. For some customers, reboots may occur depending upon the tags applied.
Marketplace Systems subject to these change guidelines: (For complete guidance click on the title)
DSH including the Hub, EDI, EFT, and ESDCU components, FFM including the EE, SES, IES, DSRS, Correspondence, MCR components, and supporting platform integrations for Mutual TLS, Shared Services, and Egress Network Firewall components, MIDAS, MNPS (Notice Generation), Access (SLS, SLSGW), Apply (Marketplace Eligibility Application (MEA / App 3.0) and 2.0 Codebase, Income Calculator), Accounts (My Account Evolution (MAEv), Accounts UI), API (MAPI, FLH API), Enroll (PC2, Window Shopping), ITT/CITSS (Performance testing restrictions during OE dates)
- October 31 – November 3: Teams can resume performance testing activities after 8:00 AM EST on November 3, 2026.
- December 11 – 16: Teams can resume performance testing activities after 8:00 AM EST on December 16, 2026.
- January 12 – 16: Teams can resume performance testing activities after 8:00 AM EST on January 16, 2027.
October 1, 2026, 12:00 AM - January 16, 2027, 5:00 AM – All the timings listed below are listed in until unless specified.
October 1, 2026 – Start of change guideline period
October 4, 11, 18 – Available Maintenance Window (Sunday 12:00 AM – 12:00 PM)
- October 4, 2026, is also the Production patching date for the September (Victor) patching cycle - this will be the last patching prior to OE for 2027
- October 2, 2026, is also planned FFE OE October release code deployment at midnight
- October 23, 2026, is also planned FFE Pre OE October release code deployment at midnight
October 24, 25, 31 – Non-Maintenance Weekend
- No planned down-time – all Marketplace systems should be available
- No infrastructure changes should be implemented
- ALL the Security Scans should be paused 10/30/2026, 8:00 PM – 11/2/2026, 8:00 PM
October 31, 2026 – November 3, 2026: No performance testing will be permitted in the lower environments. Teams can resume performance testing activities after 8:00 AM on November 3, 2026.
Development Teams working on the Marketplace under the Office of Communication (OC) should work with their CMS Product Managers and Program Managers on any development or infrastructure changes that would require downtime to deploy or update and any releases that impact teams outside of OC. If you have questions, please contact Tatum Walker or Syam Koganti
November 1, 2026 – Non-Maintenance Weekend
- No planned down-time – all Marketplace systems should be available
- No infrastructure changes should be implemented
November 1, 2026 – First Day of Open Enrollment (Sunday)
- November 1, 2026 – Daylight Savings Time ends at 2:00 AM (Sunday). Clocks will move back one hour to 1:00 AM. Please account for this time change when planning deployments or maintenance during this window. SSA Services will be unavailable from 12:01 AM - 4:00 AM.
November 8, 15, 22, 29 – Available Maintenance Window (Sunday 12:00 AM – 12:00 PM)
- November 8, 2026 - Production patching date for the October (Xray) cycle, OS patch deployment applies to all systems except components of the systems subject to these guidelines that do not support zero-downtime.
December 6, 2026 – Available Maintenance Window (Sunday 12:00 AM – 12:00 PM)
- December 6, 2026 - Production patching date for the November (Yankee) cycle OS patch deployment applies to all systems except components of the systems subject to these guidelines that do not support zero-downtime
December 11 – 16 - No performance testing will be permitted in the lower environments. Teams can resume performance testing activities after 8:00 AM on December 16, 2026.
December 12 - 15 – High Volume/Maintenance Period – No Maintenance (Before the deadline for 1/1/2027 coverage which ends on 12/16/2026 at 5:00 AM due to Alaska/Hawaii Extension)
- No planned down-time – all Marketplace systems should be available
- No infrastructure changes should be implemented
- All the Security Scans should be paused 12/13/2026, 8:00 PM – 12/16/2026, 8:00 PM
January 3, 2027 – Available Maintenance Window (Sunday 12:00 AM – 12:00 PM)
- January 3, 2027 - Production patching for the December (Zulu) cycle OS patch deployment applies to all systems except components of the systems subject to these guidelines that do not support zero-downtime
January 9 - 16 – High Volume/Maintenance Period – No Maintenance (Before the deadline for 2/1/2027 coverage which ends on 1/16/2027 at 5:00 AM when OE Ends for the FFE due to Alaska/Hawaii Extension)
- No planned down-time – all Marketplace systems should be available
- No infrastructure changes should be implemented
- All the Security Scans should be paused 1/13/2027, 8:00 PM – 1/16/2027, 8:00 PM
January 12 – 16: No performance testing will be permitted in the lower environments. Teams can resume performance testing activities after 8:00 AM on January 16, 2027.
- January 15 – Last Day of Open Enrollment **
- January 16 (at 5:00 AM) – Open Enrollment closes; Last day of the change guideline period
| 
