Four dates every IT leader should have on the calendar this fall
Three patch days, four end-of-support cutoffs and one ERP deadline land between now and the end of 2027. Here's what matters and what I'd do this week.
None of these dates is a surprise. All of them are easy to miss when your team is already stretched, and together they decide how exposed many mid-market companies will be going into 2027.
The dates
| Date | What happens | Who should care |
|---|---|---|
| Oct 13, 2026 | SAP Security Patch Day and Microsoft Patch Tuesday | Anyone running SAP NetWeaver, S/4HANA or Windows |
| Oct 13, 2026 | Final security updates for Windows Server 2012 and 2012 R2 and for Windows 10 consumer extended updates; Windows 10 Enterprise LTSB 2016 reaches end of support; Windows Server 2022 leaves mainstream support | Anyone with older servers, shop-floor PCs or kiosks |
| Oct 20, 2026 | Oracle's quarterly Critical Patch Update | E-Business Suite, JD Edwards, PeopleSoft and Oracle Database teams |
| Nov 1, 2026 | Extended security coverage ends for Exchange Server 2016 and 2019 | Anyone still running Exchange on-premises |
| Dec 31, 2027 | Mainstream maintenance ends for SAP ECC 6.0 on enhancement packages 6 to 8 | Every ECC customer; EHP 5 and earlier already left mainstream maintenance in 2025 |
Patching has become a capacity problem
Look at the volume. Microsoft's September release fixed roughly 970 vulnerabilities, a record, and two were already being exploited. Oracle's July update carried 1,449 security patches, and Oracle now ships security updates monthly on top of its quarterly cycle. SAP released 19 new notes in September, four of them rated critical.
Most IT teams I talk to are not short on discipline. They are short on hours. A patch program built for a few dozen fixes a month can't absorb a thousand.
What I'd do this week
- Inventory the stragglers. List everything on Windows Server 2012 or 2012 R2, Windows 10, Windows 10 LTSB 2016, and Exchange 2016 or 2019. Shop-floor PCs, kiosks and that one forgotten file server hide here.
- Decide: upgrade, isolate or bridge. Extended updates buy time, but they're a bridge, not a plan.
- Patch what's being exploited first. September's two exploited Microsoft flaws come before the other 960-plus.
- Book test windows now. Reserve time for October 13 and October 20 so SAP and Oracle patching doesn't collide with month-end close.
- Check your ECC release level. If you're on enhancement package 5 or earlier, you're already outside mainstream maintenance.
Where outside help pays off
If the inventory turns up more than your team can handle, three options are worth pricing: managed patching for SAP or Oracle, managed detection and response to cover the gap while you upgrade, or a short project to retire what you can. We'll help you compare them at no cost, and we'll measure whoever does the work against the SLA they promised.
Want a second set of eyes on this?
A free 30-minute call with a solution architect. General inquiries: info@netvarista.com