October Patch Tuesday Preview: Microsoft Faces Office Support Fallout
September 2026 Patch Tuesday broke records with 973 CVEs across Microsoft products, though only two were known to be exploited and none were publicly disclosed. The upcoming October release is expected to focus on Office, as Microsoft continues issuing security fixes for Office 2016 and 2019 after their end of support. A recent update meant for Microsoft 365 caused those older Office versions to be removed or deactivated, prompting Microsoft to pause it and adding pressure to migrate users to newer versions.
September's Microsoft security release covered 973 vulnerabilities, a record, but only two were flagged as actively exploited and none publicly known. October's forecast centers on Office, especially 2016 and 2019 editions that Microsoft still patches despite ending support.
A Microsoft 365 update, KB5002907, reportedly left those older suites missing or inactive, prompting a pause. Microsoft has also combined its semi-annual and monthly enterprise channels and renamed several others, reflecting ongoing maintenance complexity.
Organizations still running Office 2016 or 2019 may face disruption if updates remove or disable applications, affecting productivity and security patching. IT teams could spend more time testing and migrating users, while employees may encounter unexpected outages. The record volume of fixes may strain smaller security teams, though the low number of exploited flaws suggests immediate risk remains limited for many.