October 2026 Patch Tuesday forecast: Time for an Office cleanup
October 2026 Patch Tuesday forecast after September's record 973 Microsoft CVEs; Apple already patched exploited zero-day CVE-2026-86950.
September 2026 Patch Tuesday set an all-time record with 973 CVEs across Microsoft's portfolio, though only CVE-2026-85880 and CVE-2026-81963 were listed as Known Exploited. Apple released macOS 27 Golden Gate on September 14 and patched actively exploited zero-day CVE-2026-86950 on September 29. Microsoft's post-EOS updates for Office 2016/2019 caused widespread removals and deactivations, forcing a pause of KB5002907. Next week's Patch Tuesday brings final updates for Windows 11 24H2 Home/Pro and the end of ESU support for Exchange Server 2016/2019.
- September 2026 set record: 973 Microsoft CVEs patched; only two known exploited, none publicly disclosed.
- Apple patched exploited zero-day CVE-2026-86950 across all OSes on September 29.
- KB5002907 update wrongly removed/deactivated Office 2016 and 2019; Microsoft paused it.
- October Patch Tuesday ends Windows 11 24H2 Home/Pro support and Exchange 2016/2019 ESU.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-62721 | Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally | 7.8 | <1% | ||
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
| CVE-2026-85921 | Double Free in Windows Secure Kernel Mode Enables Local Privilege Escalation | 8.2 | — | ||
| CVE-2026-86950 | Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS | 8.8 | 26% | KEVPoC ×3 | KEV |
From the original article
4 min read at helpnetsecurity.com
September 2026 Patch Tuesday set an all-time record with 973 CVEs addressed across the Microsoft portfolio. We’re only four months into the Patch Apocalypse and everyone seems to be numb with respect to the insane number of CVEs reported. Despite this massive number, only two, CVE-2026-85880 and CVE-2026-81963, were reported Known Exploited and none were Publicly Disclosed.
helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.