October 2026 Patch Tuesday forecast: Time for an Office cleanup

September 2026 Patch Tuesday set an all-time record with 973 CVEs addressed across the Microsoft portfolio. We’re only four months into the Patch Apocalypse and everyone seems to be numb with respect to the insane number of CVEs reported. Despite this massive number, only two, CVE-2026-85880 and CVE-2026-81963, were reported Known Exploited and none were Publicly Disclosed. So for most of us, it’s still business as usual, patch systems at highest risk, but be prepared for large reports showing just how many vulnerabilities were addressed.

Office Update risks and migration confusion after end of support

Microsoft officially announced the end-of-support (EOS) for Office 2016 and Office 2019 almost a year ago with the caveat ‘at Microsoft’s sole discretion, we may choose to issue one or more updates to Office 2016 after October 14, 2025.’ True to their word (pun intended) they’ve continued to release security updates almost monthly for both product sets since that EOS date. The problem is that because these products are not part of mainstream support, they are probably not tested with the latest updates released for other purposes.

Case in point, Microsoft released KB5002907 designed to update out-of-date Microsoft 365 applications. As soon as this KB was released, there were reports of Office 2016 and Office 2019 being removed or deactivated. This problem was so widespread that Microsoft was forced to pause the update. There’s clearly an argument to be made that it is time to truly end support for these products and help customers migrate to newer versions.

The question then becomes what does your company move to? The challenge is Microsoft continues to release new major versions of Office, i.e. Microsoft 365 or Office 2024, as well as to introduce new channels or just to rename channels based on ever-changing support strategies. Do these sound familiar?

• Beta – Formerly named Insider (or Insider Fast)
• Current Channel (Preview) – Formerly named Monthly Channel (Targeted) (or Insider Slow)
• Current Channel – Formerly named Monthly Channel
• Monthly Enterprise Channel – Introduced as a new channel in May/June 2020
• Semi-Annual Enterprise Channel (Preview) – Formerly named Semi-Annual Channel (Targeted)
• Semi-Annual Enterprise Channel – Formerly named Semi-Annual Channel

I’m only pointing this out because there is another argument to be made that Office is challenging to maintain and could use some cleanup with respect to terminology and support. I will point out that starting in July, Microsoft has consolidated the Semi-Annual Enterprise Channel and the Monthly Enterprise Channel into a single, combined enterprise update channel. This is the first step in the right direction.

Apple launches Golden Gate and patches zero-day

Apple released macOS 27 Golden Gate on September 14th this month. In keeping with their three-version support policy, they will be dropping support for Sonoma, and maintaining Sequoia, Tahoe, and Golden Gate moving forward. They also reported a zero-day exploit for CVE-2026-86950 and provided updates for all operating systems on September 29th.

Windows 11 26H2 arrives ahead of critical fixes and support cutoffs

Microsoft released Windows 11 26H2 on September 29th. This new operating system shares the same kernel with Windows 11 24H2 and Windows 11 25H2, so those versions can be updated with an Enablement Package direct to Windows 11 26H2 with minimal interruption.

Microsoft did release several out of band patches for Windows 10, Windows 11 and Server 2025 on September 14th last month. They addressed issues with remote desktop services stopping, Hyper-V host folder shares disappearing inside Linux VMs, and USB audio devices going silent. The Windows 11 update counts as a security update because it covers CVE-2026-62721 and the Windows 11 26H1 also fixes CVE-2026-85921. The Windows Server updates are marked non-security.

Next week’s Patch Tuesday will include the final updates for Windows 11 Version 24H2 Home and Professional editions, ESU support for Server 2012 and 2012 R2, and the end of ESU support for Exchange Server 2016/2019. Microsoft has also reported they will be including a fix for the cut-and-paste failure issue in Excel which has plagued many users since the September security updates, and also look for a fix for the File History/Windows Backup issue which was also created by the September security updates.

October 2026 Patch Tuesday forecast

• Another record setting month for CVE fixes from Microsoft? I think it will taper off a bit but still expect high numbers and most of the portfolio getting updates.
• Adobe has fallen into a bi-weekly release schedule for their products. The last round included updates for Premiere, Content Credentials, Substance 3D Modeler, Bridge, Connect, and InDesign on September 21st. They will be scheduled for the next round soon, so expect updates next week. Also be aware they moved their update site to the Adobe Trust Center.
• Apple provided their latest updates on September 29th for all operating systems, so I don’t expect anything else coming soon.
• Google will release the next update to Chrome for Desktop 156 next week as usual.
• The last major round of security updates for Firefox and Thunderbird were on September 29th. We should expect at least of these will receive updates next week.

If you get a break from the Patch Apocalypse, take a look at your Microsoft Office environment and consider the time you spend supporting it. Also consider your support desk and staff with respect to the volume of Office support questions and issues they get. If you have a lot of outdated or older versions still running, it may be time for a refresh and consolidation of applications.