October 2026 Patch Tuesday for Azure-hosted Windows Servers - which fixes to rush, how to find exposed VMs and how to roll out

#What needs your attention

From the October 2026 release (13 October), the items that matter most for servers:

The Azure service CVEs fixed the same month (Azure SRE Agent, API Center, Event Grid) were mitigated by Microsoft on the service side; no customer action is needed for those.

SQL Server had its own security updates the same day. See the SQL Server October 2026 post.

#1. Group VMs by risk

Patch order is driven by role and exposure, not by VM count:

1. Internet-facing roles: RD Gateway, AD FS / WAP, Exchange, SharePoint, anything with a public IP.
2. Domain controllers and DHCP servers (AD DS and DHCP RCEs reach the heart of the network).
3. Servers with MSMQ enabled.
4. Hyper-V hosts (Azure VMs rarely run nested Hyper-V, but Arc-enabled on-premises hosts do).
5. Everything else, with the normal ring schedule.

Find role candidates with tags if you tag by role, and check features on the machines themselves:

# run through Run Command or Arc on each candidate
Get-WindowsFeature DHCP, MSMQ*, Hyper-V, AD-Domain-Services, RDS-Gateway, ADFS-Federation |
  Where-Object Installed | Select-Object Name

Find VMs with public IPs using Azure Resource Graph:

Resources
| where type =~ 'microsoft.network/networkinterfaces'
| mv-expand ipconfig = properties.ipConfigurations
| where isnotempty(ipconfig.properties.publicIPAddress.id)
| project nic = name, vm = tostring(properties.virtualMachine.id), resourceGroup

#2. Roll out with Azure Update Manager

• Run Check for updates (assessment) on the high-risk group first so you can see the October cumulative update is pending.
• Create a one-time maintenance configuration for the high-risk group (classification Critical and Security), schedule it in the next available window, and pre-stage reboots.
• Keep domain controllers in at least two batches so one DC is always up.
• For Exchange and SharePoint, follow the product's own patch process (Exchange SU, SharePoint configuration wizard). The Windows update alone isn't enough.

Track compliance with Resource Graph:

patchassessmentresources
| where type =~ 'microsoft.compute/virtualmachines/patchassessmentresults/softwarepatches'
   or type =~ 'microsoft.hybridcompute/machines/patchassessmentresults/softwarepatches'
| where properties.classifications has 'Security' or properties.classifications has 'Critical'
| extend machine = tostring(split(id, '/patchAssessmentResults/')[0])
| summarize pending = count() by machine
| order by pending desc

#3. If you can't patch a role straight away

These reduce exposure; they don't replace the patch.

#4. Verify

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 3

Compare the installed KB with the October 2026 cumulative update for that Windows Server version in the Microsoft update catalogue, and re-run the Update Manager assessment so the dashboard reflects the result.

#Checklist

• VMs grouped by role and internet exposure
• High-risk group patched within days, not the normal monthly ring
• Domain controllers patched in batches
• Exchange/SharePoint product patch steps completed
• Interim mitigations for anything delayed
• Compliance query shows no pending Critical/Security updates

#Sources

• CrowdStrike: October 2026 Patch Tuesday analysis