Patch Tuesday 2026 Forecast: Office 2016/2019 End‑of‑Support and Known‑Exploited CVEs (CVE‑2026‑85880, CVE‑2026‑81963)
What It Is – Microsoft’s October 2026 Patch Tuesday includes 973 CVEs across its portfolio, but only two (CVE‑2026‑85880 and CVE‑2026‑81963) are flagged as known‑exploited and have not yet been publicly disclosed. Both affect legacy Office 2016 and Office 2019 installations that are past mainstream support.
Exploitability – The two CVEs are confirmed in the wild (known‑exploited) but details remain undisclosed, indicating active threat‑actor use. No public proof‑of‑concept is available, but the lack of disclosure suggests attackers are leveraging them silently.
Affected Products – Microsoft Office 2016, Office 2019, and any out‑of‑date Microsoft 365 client components that still run on those legacy binaries.
Why It Matters for Trust & Control Assurance
- Patch Management Discipline – Demonstrates the need for a documented, repeatable process that tracks patch status for every software asset, especially those out of mainstream support.
- Evidence of Due Diligence – Continuous collection of patch‑compliance evidence satisfies auditors that the organization is actively mitigating known‑exploited flaws.
- Defensible Audit Trail – Maintaining logs of patch deployments, exceptions, and migration plans creates a defensible record for regulatory reviews and enterprise‑level security assessments.
Recommended Actions
- Inventory Legacy Office Deployments – Identify all endpoints still running Office 2016/2019.
- Prioritize Known‑Exploited CVEs – Apply any available mitigations or work‑arounds immediately; monitor Microsoft advisories for patches.
- Accelerate Migration – Develop a roadmap to move to Microsoft 365 or Office 2024, documenting milestones for audit purposes.
- Capture Patch‑Compliance Evidence – Use automated tooling to record patch status, approval workflows, and remediation timelines.
- Review Update Channels – Align with Microsoft’s consolidated Enterprise update channel to reduce complexity and improve consistency.
Source: Help Net Security – October 2026 Patch Tuesday forecast