October 2026 Patch Tuesday: Excel paste finally fixed, File History restored, and 24H2 Home/Pro gets its last update
It is the second Tuesday of October, and Microsoft's monthly security updates are rolling out. This one carries extra weight: it is the last Patch Tuesday ever for Windows 11 24H2 Home and Pro, the final update day for Windows Server 2012 under extended support, and the day two of September's most annoying regressions finally get buried. Here is everything that shipped, what got fixed, what is still broken, and what you should do about it.
The updates, by the numbers
The headline cumulative update is KB5127648, which covers Windows 11 24H2, 25H2, and 26H2 in a single package. Installing it takes 24H2 to build 26100.9711, 25H2 to 26200.9711, and 26H2 to 26300.9711. Windows 11 26H1 gets KB5127646 (build 28000.3231), and 23H2 gets KB5126653 (build 22621.7652). On the server side, Windows Server 2025 takes KB5126646 (build 26100.33650) and Server 2022 takes KB5126655 (build 20348.5761). The older branches are still in the mix too: Windows 10 1809 and Server 2019 get KB5126651 (build 17763.9376), and Windows 10 1607 and Server 2016 get KB5126868 (build 14393.9612).
One branch is conspicuously absent. As of this afternoon, Windows 10 22H2 and 21H2 (LTSC 2021) have no October cumulative update in the Update Catalog or on Microsoft's release info pages. The newest thing on those branches is still the September 14 out-of-band update. That is unusual, and it is worth checking Windows Update again later this week if you run 22H2. The same gap applies to the .NET Framework updates, which shipped for every other branch today.
Speaking of .NET: there is a full set of October .NET security and quality rollups, KB5127690 through KB5128928 depending on your Windows version and framework combination. Server 2012 and 2012 R2 get their own .NET rollups as part of their final extended support release, more on that below.
A quieter month for CVEs, with one big enforcement
Here is the strange part. As of this afternoon, Microsoft's Security Update Guide showed only eight CVEs for October, and all eight came from an October 2 early release covering cloud and service-side products: Azure App Service, API Center, Event Grid, Dataverse, Bookings, Partner Center, the Azure SRE Agent, and Exchange Server (CVE-2026-96940, which was already folded into the September Exchange update reissue). None are listed as exploited in the wild or publicly disclosed.
The main Patch Tuesday release note had not appeared in the guide yet when we checked, so treat that eight as a floor, not the final total. Microsoft sometimes staggers the publication. If the full Windows and Office CVE list lands later today, we will update this piece.
The security story with teeth is not a new CVE but an old one reaching enforcement. CVE-2026-56155, the Active Directory Federation Services elevation-of-privilege flaw from July, flips to automatic remediation with today's updates. If your AD FS deployment still has insecure permissions on its DKM container, the October updates fix the ACLs for you by default. Admins who need to hold off can opt out by setting RemediateDkmAcl to 0, but Microsoft's direction is clear: the grace period that started with audit mode in July is over. We covered the enforcement mechanics in detail this morning, so check those pieces if you run AD FS.
September's regressions: both fixed
This is the part many of you have been waiting for. September's updates broke two unrelated things, and October closes both.
First, Excel. The September Office security update KB5002914 broke cut and paste in Excel 2016 through 2024: you would copy cells, paste, and nothing would happen. No error, no warning, the destination just sat there unchanged. Microsoft shipped a partial fix on September 18 that handled the general case but left one hole open: workbooks containing conditional formatting could still fail to paste. As of the revised KB5002665 notes, that hole is closed. Microsoft's wording now says the conditional-formatting failure applied to a previous version of the update and the latest version provides the complete fix. Office 2019 picked up the complete fix in build 10417.20211. If you have been living on Paste Special for the last month, you can go back to Ctrl+V.
Second, File History. September's Windows update KB5124008 broke File History and Windows Backup for a lot of people: the dreaded "Reconnect your drive" message on a perfectly working drive, frozen backup timestamps, "no previous version available" on files you knew were backed up. Microsoft shipped the fix in optional preview updates on September 22 and 23 for 24H2, 25H2, and 26H1, which left everyone else waiting for today. The wait is over for most: Windows 11 23H2 gets the fix explicitly in KB5126653, and for 24H2, 25H2, 26H2, and 26H1 the fix is now rolled into the automatic cumulative update instead of an optional preview. One gap in the documentation: the October changelogs for the 1809/1607 and Server 2019/2016 branches do not mention File History, so if you are on one of those older branches, verify your backups are actually running after updating. The quick check still works: open File History in Control Panel and confirm the last backup timestamp is moving again.
Still broken: USB audio
Not everything got fixed. The USB Audio Class 1.0 problem, devices throwing Code 10 errors or producing no sound at all, remains an open known issue in the October updates for 24H2, 25H2, 26H2, 26H1, Server 2019, and Server 2016. September's out-of-band updates only fixed the 8-channel and 3D audio symptoms; Microsoft says it is still working on the rest. If you are an admin who needs a workaround now, Microsoft's guidance is to contact business support. Curiously, the 23H2 October article lists no known issues at all, so 23H2 users appear to be in the clear on this one.
Deadline day: what ends today
October 13 was already circled on a lot of calendars, and we covered the deadlines in depth last week. The short version: Windows 11 24H2 Home, Pro, Pro Education, Pro for Workstations, and SE get their last update today, KB5127648 is the end of the line. Windows 10 commercial Extended Security Updates Year 1 ends, and Year 2 doubles to $122 per device. The consumer ESU program ends today with no extension. Windows Server 2012 and 2012 R2 received their final ESU monthly rollups this morning, KB5126835 and KB5126836, closing out three years of extended support. Office 2021, including LTSC 2021 and Project and Visio 2021, is out of support with no ESU path at all. Also quietly ending: Windows 10 Enterprise LTSB 2016, and Windows Server 2022 leaves mainstream support for extended support through 2031.
If you are still on 24H2 Home or Pro, the move is straightforward. Unmanaged machines should get auto-upgraded by Microsoft, but managed or update-deferred machines need a deliberate push. 25H2 remains the safe, documented step, and 26H2 is the newer option on the same platform via a small enablement package. Either one resets your support clock.
Worth knowing in the fine print
A few more things in today's cumulative updates worth a mention. ReFS volumes on externally attached storage get new auditing controls, enabled by default, with enforcement left off unless you turn it on. Secure Boot certificate deployment continues across all branches. The on-device AI components on 24H2 and later move to version 1.2608.951.0. Server 2025 picks up Quick machine recovery support (off by default), post-quantum ML-KEM key exchange in TLS 1.3, and cURL 8.21.0. Time zone data adds permanent daylight saving time for British Columbia and Alberta starting next month, plus a new Manitoba zone. And the fix list includes the multi-user black screen in File Explorer on Azure Virtual Desktop, Always On VPN stuck connecting, tiered Storage Spaces Direct disks failing to come online, gaming mouse stutter, Windows Hello fingerprint failing after a cold boot, August printing failures, and the AC-3 audio crashes.
On the Exchange side, there is no new October security update. The latest remains the October 2 reissue of the September update, which added the CVE-2026-96940 fix. And a reminder for the holdouts: October is the final month of Extended Security Updates Period 2 for Exchange 2016 and 2019. There is no Period 3. After this month, those servers get nothing.
What to do now
Install today's updates. Check your build number afterward against the list above to confirm you actually got them. If you are on Windows 10 22H2 and Windows Update shows nothing new, check back later this week. Verify File History is backing up again if September broke it for you. And if you are on 24H2 Home or Pro, or managing machines that are, make the 25H2 or 26H2 move this week while it is still a planned migration and not an emergency.