Record Patch Tuesday and a Doubling Windows 10 Bill

Week of 26 October 2026 | Compiled by Team Paringa

Managed endpoint operations are being squeezed from two sides this week: record security patch volume and a rising price to keep ageing Windows 10 devices alive. Both favour providers that can run patching, refresh and support as one service.

What Happened This Week

🔴 Record Patch Tuesday with an exploited Windows Shell zero-day

Microsoft's October Patch Tuesday on 13 October fixed between 1,407 and 1,413 CVEs depending on the tracker, with about 1,102 in Windows across 176 updates. Vicarius called it the largest release on record, 46 percent above September's 964. Tenable counted 69 critical and 1,337 important, while Ivanti counted 78 critical.

The headline flaw is CVE-2026-96951, a Windows Shell security feature bypass affecting Mark of the Web, rated CVSS 8.8 and exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog. It strips the download-origin tag so Windows shows no warning, affecting Windows 10, Windows 11 and Windows Server 2012 R2 through 2025, with no patch for Server 2012. A victim must open a crafted file or follow a malicious link. It is the seventh Mark of the Web bug exploited as a zero-day since January 2022, out of 32 patched. Also patched were a publicly disclosed .NET Framework bypass of Windows Defender Application Control (CVE-2026-108398) and a SharePoint bug (CVE-2026-102866).

For any organisation running its own endpoint patching, a release this size means more testing, more reboots and more exceptions to manage in a single cycle. Note that counts differ by source, and the figures above come from a secondary write-up of those trackers.

Sources: WindowsForum: Windows 11 October 2026 Update, exploited Windows Shell zero-day

Patch volume is now a staffing problem, not a tooling problem. Ask clients how many devices were patched and verified within seven days of 13 October, and how many are still pending. The gap is the conversation. Paringa's managed endpoint service takes patch validation and reporting off internal teams so one record month does not stall a project backlog.

🟡 Windows 11 passes 71 percent and the Windows 10 bill is set to double

The Register reported on 5 October that Windows 11 rose to 71.5 percent share and Windows 10 fell to 27.77 percent, per Statcounter, an estimate drawn from tracking code on over 1 million sites. Windows 10 reached end of support on 14 October 2025. Commercial Extended Security Updates cost $61 per device in year one, doubling to $122 in year two, for a maximum of three years.

Lansweeper's Esben Dochy said enterprises moved actively in the first ESU year, leaving "stickier" devices, and expects a "small bump" around renewal but that the steep part of the curve is likely over. The remaining Windows 10 devices are the hard cases: old hardware, specialist apps and low-priority users.

Sources: The Register: Windows 11 market share creeps upwards as cost of staying on Windows 10 set to double

The easy refresh is done, so what is left needs an inventory and a plan, not a blanket order. Price the ESU renewal against refresh cost for each remaining device class. Paringa can run that audit and fold refresh, support and lifecycle into a single managed fee.

🟡 Microsoft's October MSP update centres on Windows 365 and Intune

Microsoft Partner News published its October 2026 update for managed service providers, last modified 22 October, covering Windows 365 and Intune updates, partner solutions and MVP guidance. We could only confirm the page headline and scope, not the detailed announcements, so check the post directly before quoting specifics to clients.

The direction is consistent with the market: cloud-managed endpoints and cloud PCs as the default control plane for providers.

Sources: Microsoft Partner News: What's new for MSPs, October 2026

Treat this as a prompt to review which clients are still on legacy imaging and on-premises management. Cloud-managed endpoints make remote patching and refresh far cheaper to run.

What IT Leaders Are Dealing With

Endpoint teams face rising volume with flat headcount. Record patch cycles, exploited zero-days that reach both Windows 10 and 11, and a Windows 10 tail that costs more each year all land on the same small group. The sensible response is less about new tools than about deciding which devices to refresh, which to pay ESU for, and which work to hand to a provider with scale.

Buyers also want predictability. A fixed per-device managed price that bundles patching, support and refresh is easier to budget than reacting to each Patch Tuesday and each ESU renewal.

Three Things Worth Watching Next Week

1. CVE-2026-96951 exploitation reports — Watch for CISA or vendor updates on how widely the Mark of the Web bypass is used in phishing campaigns.

2. Windows 10 ESU renewal planning — Year two pricing of $122 per device will drive budget requests as 2027 plans are set.

3. Details of Microsoft's Windows 365 and Intune MSP changes — Fuller coverage of the partner announcements should clarify what providers need to change.

Questions? hello@paringa.ai

Paringa runs managed IT services and end-user computing so your team spends less time on patching and refresh cycles. We give you one accountable partner for the Windows fleet, from support desk to device lifecycle. | 26 October 2026 | © Paringa Ltd