Patch Tuesday

October 2026 for Microsoft admins: what changed on the 1st, and what ends on Patch Tuesday

October 2026 for Microsoft admins: what changed on the 1st, and what ends on Patch Tuesday

by Jan Holbo Rasmussen

Tomorrow is Patch Tuesday, and this one is more than a batch of fixes. Several products get their last update on the same day, three things already changed on 1 October, and a Secure Boot certificate expires six days later. Here is the month as a list, with what to check for each.

Already happened: 1 October

Exchange Web Services is off by default

Exchange Online now blocks Exchange Web Services (EWS) unless the tenant has asked for it to stay on. Microsoft’s message to admins was: “Beginning October 1, 2026, EWS will be blocked unless the tenant configures an AppID AllowList”, and without one “Microsoft will set EWSEnabled=False and EWS apps will stop working.” [1]

Read article →
Tags: #patch tuesday #microsoft 365 #exchange online #ews #end of support #secure boot
September 2026 Patch Tuesday broke Excel: the case for ring-based deployment

September 2026 Patch Tuesday broke Excel: the case for ring-based deployment

by Jan Holbo Rasmussen

September’s Patch Tuesday was the biggest Microsoft has ever shipped, and one of the updates in it broke copy and paste in Excel. Together they make a good argument for something small IT departments often skip: letting a few people get the updates first.

What shipped on 8 September 2026

A record count, however you count it

How big depends on who you ask. BleepingComputer counted 966 vulnerabilities [1], Tenable 964 [2], the Zero Day Initiative 972 new Microsoft CVEs [3] and SecurityWeek 974 [4]. When I first noted the idea for this post I wrote down 973, which is roughly what you get from reading enough headlines.

Read article →
Tags: #patch tuesday #windows update #microsoft 365 apps #excel #ring deployment