Note

Updated 13 October 2026, after the release. This post went out the day before Patch Tuesday. It now says what actually shipped: 1,411 fixes, one of them for a flaw that is already being used in attacks, and one known issue with USB audio. The other sections are brought up to date as well.

Patch Tuesday was on 13 October, and this one was more than a batch of fixes. Several products got their last update on the same day, three things had already changed on 1 October, and a Secure Boot certificate expires six days later. Here is the month as a list, with what to check for each.

Already happened: 1 October

Exchange Web Services is off by default

Exchange Online now blocks Exchange Web Services (EWS) unless the tenant has asked for it to stay on. Microsoft’s message to admins was: “Beginning October 1, 2026, EWS will be blocked unless the tenant configures an AppID AllowList”, and without one “Microsoft will set EWSEnabled=False and EWS apps will stop working.” [1]

EWS is the old way for other programs to read mailboxes and calendars. What still uses it tends to be the things nobody has touched for years: backup tools, signature managers, CRM plugins, room booking screens.

One well-known program is on that list. heise reports that Apple Mail and Apple Calendar on the Mac use EWS for Exchange Online, that the current macOS does not yet support the replacement, and that they “may experience a complete failure” [2]. Apple has said that support will come in a later update to macOS 27, without giving a date [2]. iPhones and iPads are not affected, because they use a different protocol [2].

What to do:

  • If something stopped working for Mac users or in an integration on or after 1 October, this is the likely reason.
  • You can turn EWS back on for specific apps with an allow list, but only until 1 April 2027: “After April 1, 2027, EWS access will be permanently removed with no re-enablement.” [1]
  • The replacement is Microsoft Graph [1]. Ask each vendor when their product moves to it.
  • Exchange Server on your own hardware is not affected [1].

Publisher is gone from Microsoft 365

“Microsoft 365 subscribers will not be able to access Publisher after October 1, 2026.” [3] If someone in the organisation still has .pub files, they need a PC with a perpetual version of Publisher to open them and save them as PDF. I have written more about that in the post on Office 2021.

Teams and Copilot have new addresses

Covered in its own post: Teams and Copilot are moving to cloud.microsoft. If you have not checked your firewall and proxy rules yet, do that now.

Tuesday 13 October

The last update for three products

These got their final update on 13 October:

  • Windows 11 24H2, Home and Pro [4]. Enterprise and Education continue on 24H2 until October 2027. More in the Windows post.
  • Office 2021 and Office LTSC 2021, with “no extension and no extended security updates” [5].
  • Publisher in the perpetual versions [3].

Microsoft confirmed the first of these on the day: “Windows 11, version 24H2 Home and Pro has reached end of updates. The October 2026 monthly security update is the last update available for these editions.” [6]

Windows 10 is not on the list. The extended security updates for home users were extended to 12 October 2027 [7], and Windows 10 got its October update like the rest [8].

What to do now: an inventory, if you have not made one. Which PCs are on Windows 11 24H2 with Home or Pro, and which have Office 2021? Those machines have had their last fixes. From November they fall further behind every month.

What actually shipped

The numbers

It is the largest Patch Tuesday Microsoft has released. BleepingComputer counts 1,411 vulnerabilities fixed, 70 of them rated critical [9]. That count only covers what was released on the day itself; another 348 flaws had been fixed earlier in the month [9]. September, which I called the largest so far, had under a thousand.

By type, the largest groups are 677 that let an attacker gain higher privileges, 317 that allow running code remotely and 254 that leak information [9]. The explanation BleepingComputer gives for the size is that “Microsoft continues to use artificial intelligence platforms to find and remediate security vulnerabilities in its products” [9].

Three zero-days, one already in use

  • CVE-2026-96951, Windows Shell. This is the one that matters most, because it is being exploited already. It lets an attacker get around a security feature in Windows [9]. Microsoft has not said who found it or how it is being used [9].
  • CVE-2026-108398, .NET Framework. Publicly known before the fix, not seen in attacks. Reported by James Forshaw of Google Project Zero [9].
  • CVE-2026-92707, MessagePack-CSharp. Publicly known before the fix. It lets an attacker make a service stop responding [9].

What the update is called

For Windows 11 it is KB5127648, for versions 26H2, 25H2 and 24H2 [6]. For Windows 10 with extended security updates it is KB5126657 [8].

Known issue: USB audio

One problem is carried over from September and is not fully fixed. Some USB audio devices of the older kind (USB Audio Class 1.0) fail to start or give no sound. Microsoft lists the signs: an error in Device Manager saying “This device cannot start (Code 10)”, no audio output, and volume controls that don’t respond [6]. An update outside the normal schedule on 14 September fixed part of it, and Microsoft says it is working on the rest [6].

If you have USB headsets, conference speakers or audio interfaces in use, put one of them in your pilot group.

What to do with it

With a flaw in Windows Shell already being exploited, this is not a month to wait long. I would still not push 1,411 fixes to every PC at once. A pilot group first, for a day or two, and then the rest. I wrote about why in September 2026 Patch Tuesday broke Excel, when one of that month’s Office updates broke copy and paste.

Monday 19 October: a Secure Boot certificate expires

The certificate that Windows’ boot loader has been signed with since 2011, “Microsoft Windows Production PCA 2011”, expires on 19 October 2026. Its replacement is “Windows UEFI CA 2023” [10]. Two related certificates expired in June [10].

A PC that has not received the new certificates still starts and still gets ordinary Windows updates. What it loses is described by Microsoft: such devices “will no longer be able to receive new security protections for the early boot process” [10].

The October update keeps rolling the new certificates out: Microsoft says they are delivered through Windows Update to devices that are eligible [6]. Most PCs that have been updated regularly have them already. The ones to check are those that have been switched off for a long time, virtual machines, and anything with unusual firmware.

The checklist

  1. Exchange Online: anything broken since 1 October? Check EWS, and plan for 1 April 2027.
  2. Publisher files: convert them while a working Publisher exists.
  3. *.cloud.microsoft: allowed in firewall and proxy.
  4. Inventory: Windows 11 24H2 Home/Pro and Office 2021 have had their last update.
  5. October’s update (KB5127648 on Windows 11): pilot group first, with a USB audio device in it, then everyone within days.
  6. Secure Boot: PCs that have been off for months, before 19 October.

Sources

  1. MC1227454: Exchange Web Services (EWS) retirement update (Microsoft 365 message center, via mc.merill.net), pulled 2026-10-04, rechecked 2026-10-11
  2. Exchange Web Services shutting down: Apple Mail is not yet ready (heise online), pulled 2026-10-04, rechecked 2026-10-11
  3. Microsoft Publisher will no longer be supported after October 2026 (Microsoft Support), pulled 2026-10-04
  4. Windows 11 Home and Pro lifecycle (Microsoft Learn), pulled 2026-10-04
  5. End of support for Office 2021 (Microsoft Support), pulled 2026-10-04
  6. October 13, 2026, KB5127648 (OS Builds 26300.9711, 26200.9711 and 26100.9711) (Microsoft Support), pulled 2026-10-13
  7. Windows 10 Consumer Extended Security Updates (ESU) program (Microsoft), pulled 2026-10-04
  8. Windows 11 KB5127648 & KB5126653 cumulative updates released (BleepingComputer), pulled 2026-10-13
  9. Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (BleepingComputer), pulled 2026-10-13
  10. Windows Secure Boot certificate expiration and CA updates (Microsoft Support), pulled 2026-10-04, rechecked 2026-10-11