Microsoft’s October updates land this afternoon. Get your test machines ready this morning

Today is the second Tuesday of October, so Microsoft’s monthly security updates arrive this afternoon, at about 1 PM Eastern. This brief goes out before that, so we do not know yet which bugs are fixed or whether any are already being exploited. What we do know is enough to plan the day.

We don’t know what’s in October’s patches yet. We do know which machines you will test them on, so pick them this morning.

Microsoft’s October updates land this afternoon

September’s release set a record. In Help Net Security’s forecast, Ivanti’s Todd Schell counts 973 CVEs addressed across the Microsoft portfolio last month, two of them reported as known exploited.

Schell expects October to include the final updates for Windows 11 version 24H2 Home and Pro, the last Extended Security Update for Windows Server 2012 and 2012 R2, and fixes for two problems caused by September’s updates: an Excel copy-and-paste failure and a File History/Windows Backup issue. He also expects a new Chrome release this week and probably updates from Adobe and Mozilla.

Windows admins with a September hangover

If your help desk spent the last few weeks fielding Excel paste complaints, today’s update is likely the fix. Schell also notes that Microsoft paused KB5002907, an update for out-of-date Microsoft 365 apps, after reports that it removed or deactivated Office 2016 and Office 2019. Shops still running those suites have the most to test.

Microsoft publishes the details in its Security Update Guide when the release goes live. Until then, any list of “October zero-days” you see this morning is a guess.

Line up test machines before 1 PM ET

• Pick a small pilot ring now: a few laptops, one Office 2016 or 2019 machine if you still have them, and one server per role.
• Block time this afternoon to read the Security Update Guide release notes. Check first for anything marked “Exploitation Detected” and for internet-facing roles such as Exchange, SharePoint and RDP gateways.
• Confirm WSUS, Intune or your patch tool syncs after 1 PM ET, and that deferral rings are what you think they are.
• Tell the help desk an Excel paste fix is expected, so tickets can be tied to the update once it installs.

Details

• Release timing: second Tuesday of the month (October 13, 2026), about 10 AM Pacific / 1 PM Eastern.
• Forecast items (Ivanti, via Help Net Security, October 9): final Windows 11 24H2 Home/Pro updates; last Server 2012/2012 R2 ESU; Excel cut-and-paste fix; File History/Windows Backup fix.
• Paused: KB5002907, after reports of Office 2016/2019 being removed or deactivated.
• September baseline: 973 CVEs, two reported known exploited (CVE-2026-85880, CVE-2026-81963).

Hunt / verify

• After installing, check the Excel paste and File History symptoms on the pilot machines before you widen the rollout.
• Compare installed KBs against the Security Update Guide list on internet-facing servers first.

Slack paste: Patch Tuesday is today (~1 PM ET). Details aren’t public yet. Prep: pilot ring ready (include any Office 2016/2019 box), patch tool syncing after 1 PM, read MSRC notes for anything “Exploitation Detected” before widening.

Sources

• Help Net Security: October 2026 Patch Tuesday forecast (Todd Schell, Ivanti, October 9, 2026)
• Microsoft Security Response Center: Security Update Guide

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].