SMB Security Directory

PatchWatch

Patch deadlines, actively exploited vulnerabilities, and end-of-life dates for small businesses — in plain English.

Data as of October 28, 2026

1,760 known exploited vulnerabilities in CISA's catalog — flaws attackers are already using
1,413 fixes in October 2026's Patch Tuesday — Microsoft's largest monthly release ever
Nov 10, 2026 next Patch Tuesday — Microsoft's monthly update day, always the second Tuesday

Patch this first

The one update that matters most right now, and why.

October 2026 Patch Tuesday · Released Oct 13

Microsoft's biggest update release ever: 1,413 fixes, about 78 of them Critical

Two of those fixes stand out. One flaw is already being used by attackers. Another was publicly disclosed before the fix shipped — which means attackers knew about it first.

CVE-2026-96951CVSS 8.8

Windows Shell — "Mark of the Web" bypass · already exploited

Windows normally warns you before opening a file downloaded from the internet. This flaw strips that warning away, so a booby-trapped download can open silently. CISA gave federal agencies until October 16 to fix it — treat that as your deadline too.

CVE-2026-108398CVSS 8.8

.NET / Windows Defender Application Control bypass · publicly disclosed

Application Control is the Windows feature that only lets approved programs run. This flaw lets an attacker get around it, so unapproved software can slip past a control many businesses rely on to keep PCs locked down.

What to do: install the October Windows updates on every PC and server now — don't wait for the weekend. If you use an IT provider, ask them to confirm the October cumulative update is deployed across your machines.

Actively exploited

The newest entries in CISA's Known Exploited Vulnerabilities (KEV) catalog — flaws confirmed to be in use by attackers right now. If you run one of these products, patching it jumps the queue.

Product CVE Added Federal due date Status
Adobe Commerce and Magento CVE-2026-48356 Oct 27, 2026 Nov 10, 2026
Google Brotli CVE-2026-111497 Oct 27, 2026 Nov 10, 2026
PHP Group PHP CVE-2026-109618 Oct 26, 2026 Oct 29, 2026 Due this week
PHP Group PHP CVE-2026-109619 Oct 26, 2026 Oct 29, 2026 Due this week
Arista VeloCloud Orchestrator CVE-2026-114625 Oct 23, 2026 Oct 26, 2026 Deadline passed
Collabora Collabora Online – Built-in CODE Server CVE-2026-110447 Oct 23, 2026 Oct 26, 2026 Deadline passed
EG Secure Solutions SiteGuard Server Edition CVE-2026-106931 Oct 20, 2026 Oct 23, 2026 Deadline passed
Plex Media Server CVE-2026-96656 Oct 20, 2026 Oct 23, 2026 Deadline passed
Plex Media Server CVE-2026-96655 Oct 20, 2026 Nov 3, 2026 Due this week
Plex Media Server CVE-2026-96654 Oct 20, 2026 Oct 23, 2026 Deadline passed
Plex Media Server CVE-2026-96652 Oct 20, 2026 Nov 3, 2026 Due this week
Siemens Software Center CVE-2026-110936 Oct 20, 2026 Nov 3, 2026 Due this week

Due dates are the deadlines CISA sets for US federal agencies. Nobody fines your business for missing one — PatchWatch uses them as an urgency yardstick for everyone: if the government has to fix it by Friday, it shouldn't sit in your queue for a month.

Who should care about what

  • Plex — anyone running a Plex media server at home or at the office.
  • BeyondTrust — businesses whose IT provider uses it to remote into their machines for support.
  • Atlassian — teams using Confluence or Jira.
  • Cisco Secure Email Gateway — businesses whose email is filtered through Cisco.
  • Ahsay — businesses backing up their data with Ahsay.

End-of-life watch

Software that has stopped — or is about to stop — getting security patches. Unsupported software doesn't break on day one; it just gets easier to attack every month after.

Windows 10 (version 22H2)

Support ended Oct 14, 2025

Ended

No more security patches. Still common in small offices — plan the move to Windows 11.

Microsoft Office 2016 and 2019

Support ended Oct 14, 2025

Ended

No more security patches for Word, Excel, and Outlook from these generations.

Windows 11, version 24H2 (Home/Pro)

Support ended Oct 13, 2026

Just ended

Just ended — update to version 25H2 to stay covered.

Microsoft Office 2021

Support ended Oct 13, 2026

Just ended

No more security patches — time to plan a move to a supported Office or Microsoft 365.

Windows Server 2022

Mainstream support ended Oct 13, 2026 · Extended support runs to Oct 14, 2031

Mainstream ended

Security patches continue under extended support until 2031, but new features and non-security fixes have stopped.

Windows 11, version 25H2 (Home/Pro)

Support ends Oct 12, 2027

Next up

The current version to be on. About a year of coverage left — no action needed yet.

Tool directory

The categories of software that keep a small business patched and protected, and the established names in each. Descriptions only — no scores, no rankings.

No tools match that search. Try a product name or a category like “backup”.

Starter list — informational only. Featured and sponsored placements open at launch.

The Weekly SMB Security Brief

One short email a week: what to patch, what's being exploited, what's expiring.

Signups open at launch

Sponsor PatchWatch

Put your product in front of small-business owners and IT managers who patch for a living.

Placements open at launch