Monday–Sunday, Oct 19 – Oct 25, 2026 (Eastern time)
This week's Microsoft administrator briefing covers developments from October 19 to October 25, 2026. Out-of-band security updates for .NET address the Brotli decoder and tarball ownership vulnerabilities, and CVE-2026-111497 is rated Critical by Microsoft; exploitation is not reported, but public disclosure is. This update is relevant only if you use the affected products.
The Teams Rooms Pro Management portal now enforces licenses for devices with Standard or Basic licenses, and Microsoft Edge's energy saver feature will have new defaults and setting options, enabling it by default on low battery. Looking ahead, the Simplified Energy Saver feature in Microsoft Edge is set for general availability in December 2026, and Dynamics 365 Project Operations will introduce a new Pricing tab in March 2027.
Developer Tools · .NET Blog
What changed Out-of-band security updates for .NET are being released to address the Brotli decoder vulnerability and tarball ownership vulnerability.
Why you might care The updates address the Brotli decoder vulnerability and tarball ownership vulnerability.
What to do Install the out-of-band security updates on systems that run .NET.
Microsoft source ↗ Published Oct 25, 2026
Teams, Teams Rooms · Microsoft 365 Roadmap
What changed The Teams Rooms Pro Management portal now supports and enforces licenses for devices in Teams Rooms on Windows with a Standard or Basic license.
Why you might care IT admins get a unified device management experience through the Pro Management portal where they can manage those devices with the same functionality found in Teams admin center for that license type.
What to do No action is documented in Microsoft's announcement.
Microsoft source ↗ Roadmap entry last updated Oct 22, 2026 (first-seen date unavailable)
Dynamics 365 · Microsoft 365 Roadmap
What changed A new Pricing tab appears on the contract (and later the quote) and becomes the default pricing surface, replacing the Project Price List tab.
Why you might care The new Pricing tab displays a consolidated grid of the prices that actually default for each pricing-dimension combination and date, replacing the Project Price List tab.
What to do Review any customizations or automation built against the existing tab before adopting the new Pricing tab.
Microsoft source ↗ Roadmap entry last updated Oct 22, 2026 (first-seen date unavailable)
Edge · Microsoft 365 Roadmap
What changed Microsoft Edge's energy saver feature, formerly known as efficiency mode, will have new defaults and different setting options, and will be enabled under two conditions: on low battery or when unplugged. The default will be for energy saver to be enabled on low battery.
Why you might care The BatterySaverModeAvailability policy will be used to manage the energy saver feature, and users set to Balanced savings will be mapped to have energy saver enabled on low battery.
What to do Edge will now support and recommend users to use the BatterySaverModeAvailability policy to manage the energy saver feature.
Microsoft source ↗ Roadmap entry last updated Oct 21, 2026 (first-seen date unavailable)
If you run .NET 10.0 or 11.0 on Linux, Mac OS, or Windows, there is a buffer overflow vulnerability in the Brotli decoder that could allow an unauthorized attacker to elevate privileges over a network.
Microsoft also documents a mitigation: Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompression, or they must manually invoke the Brotli decompression APIs provided by .NET.
A rating describes the flaw, not whether it is being exploited, and it matters only if you run the affected products.
Microsoft advisory ↗ Released Oct 25, 2026