top of page
Zoeken

The EUC Weekly Roundup: August 5 to 26, 2026

  • Foto van schrijver: Edwin de Bruin
    Edwin de Bruin
  • 2 dagen geleden
  • 10 minuten om te lezen

While I was three weeks away on PTO, the EUC world, of course, did not do me the courtesy of staying quiet.


In the span of one holiday: NetScaler took a critical pre-auth authentication bypass (CVSS 9.3), Microsoft's August Patch Tuesday shipped an actively exploited zero-day, and Omnissa dropped the whole Horizon 8 2606 wave, UAG and App Volumes included, the week I got back. So no gentle easing back in. This is a proper three-week catch-up, and a longer one than usual.


Grab a coffee.



Security advisories & active deadlines


NetScaler gets a critical auth bypass: CVE-2026-19490 (CVSS 9.3)

This is the one to action first. On August 19 Citrix published bulletin CTX696939 covering CVE-2026-19490, a critical authentication bypass in NetScaler ADC and NetScaler Gateway, scored 9.3 on CVSS v4.0 and exploitable pre-auth over the network with no user interaction. A companion issue, CVE-2026-19489, ships in the same bulletin. As of publication Rapid7 had not seen exploitation in the wild, but we all know how this movie ends with NetScaler: appliances that face the internet get poked fast. Fixed builds are 14.1-73.32 and later, and 13.1-63.21 and later. If you front Citrix (or anything else) with NetScaler Gateway, treat this as an emergency change window, not a next maintenance slot job. After a quiet spell on the NetScaler front, we are firmly back in the room.


Microsoft August Patch Tuesday: 421 CVEs and a real zero-day (CVE-2026-68820)

The August 11 Patch Tuesday was a big one: 421 CVEs, 42 rated Critical, and one flaw that is already being exploited. CVE-2026-68820 is a use-after-free in the Ancillary Function Driver for WinSock (afd.sys), the kernel driver behind the Windows Sockets API. A local attacker who lands a crafted app can win a race condition and elevate to SYSTEM, no user interaction required. There is also CVE-2026-62832, a link-following bug in the Windows User Profile Service that gives local elevation, which is exactly the kind of thing that matters on multi-session VDI and session hosts where everyone shares the box. Ring your images, then push it.


Entra memberOf deprecation: check before your dynamic groups quietly stop updating

Filed under quiet platform change that becomes a support fire. Microsoft is retiring the use of memberOf in a way that affects dynamic group rules, and Driek Desmet published a clear write-up on August 18 of what to check before your dynamic groups stop evaluating the way you expect. If your Conditional Access or app assignment leans on dynamic groups built with memberOf, go audit those rules now rather than wondering later why a policy stopped applying to half your fleet.


Windows 365 User Settings are being retired: migrate to Cloud PC Settings

Another retirement that landed more quietly than it should have. Microsoft is moving Windows 365 User Settings over to the new Cloud PC Settings, and Dieter Kempeneers put out a migration guide on August 8. If you manage Cloud PCs, this is a small but real piece of housekeeping you want to do on your terms.


Citrix / NetScaler


What Post-Quantum Cryptography actually costs your NetScaler

With the CVE handled above, the fresh non-security Citrix item comes from Julian Jakob, who on August 18 measured the performance impact of enabling Post-Quantum Cryptography (PQC) on NetScaler. NetScaler has supported PQC since 14.1 build 51.72, and the interesting bit here is not can you turn it on but what does it cost you in throughput and CPU when you do. If PQC is creeping onto your roadmap (and post-quantum readiness is quietly becoming a checkbox in security reviews), this is the kind of real-world measurement worth reading before you flip it on in production.


Omnissa (Horizon, Workspace ONE, App Volumes, DEM, UAG, Access)


Horizon 8 2606 is here, and there is a lot in it

The headline of the fortnight. Omnissa shipped Horizon 8 2606 on August 24 (Server build 8.19.0). This is a meaty release, so the highlights I would actually flag: the Connection Server installer now automatically stops and disables Active Directory Web Services (ADWS) during install to shrink the attack surface; Cloud Pod Architecture gains next preferred site logic so overflow sessions route to a site you choose rather than at random; True SSO now works with any third-party SAML IdP that supports SP-initiated SSO, not just Workspace ONE Access; and the whole stack (including the Blast Secure Gateway on Connection Server and UAG) moves to OpenSSL 3.5. On the console side you can now monitor UAG health and certificate expiry per pod directly from the Horizon Console, there is a new Isolated App Launch option for published apps, and SAML certificate management finally lives inside the console. The macOS Agent enters Limited Availability, Agent Auto-Upgrade now covers Nutanix AHV, and the OS Optimization Tool picked up BitLocker and device-encryption controls. Read the release notes properly before you touch a production pod, but there is genuine value in this one.


UAG 2606: hot certificate replacement and a QCOW2 image for Nutanix

Shipping alongside Horizon, Unified Access Gateway 2606 (August 24) is more than a version bump. The OS moves to AlmaLinux 9.6, and the standout feature is TLS certificate replacement without a service restart, so existing sessions stay up while new ones pick up the renewed cert. There is now a native QCOW2 image for KVM hypervisors, and specifically Nutanix AHV is qualified on it, so AHV customers should switch to the QCOW2 artifact at their next deploy rather than the old OVA. Add ECC TLS certificates with ECDSA cipher suites, plus better handling of multiple SAML signing certificates, and this is a solid security-focused release. So yes, to answer the standing question at the end of the roundup: UAG very much did have news this time.


App Volumes 2312.2, and a Horizon 2606 gotcha worth knowing

App Volumes 2312.2 is mostly a fixes release (MSIX attach across OSes, vSAN datastore replication, a read-only admin UI bug, and a new Teams launch failure on profile-only writable volumes). But the item I would not skip is a known issue in the wider 2606 wave: published applications on demand fail to launch when App Volumes 2603.1 or earlier is paired with Horizon 2606. The fix is to move to App Volumes 2603.2 or later. If App Volumes and Horizon are on your upgrade path together, sequence that carefully or your on-demand apps will simply not start.


Workspace ONE gets Relay Server as an internal alternative to the CDN

Rounding out the Omnissa section, an Omnissa technical blog post from August 25 details new Workspace ONE UEM Relay Server functionality for distributing Windows internal apps. Until now those apps went out over the built-in CDN, the default worldwide cloud distribution that pulls app files from the nearest edge. Relay Server gives you an SFTP-based, on-premises alternative that is entirely managed and controlled by the enterprise, which is exactly what you want in branch offices or anywhere extra security and full control over the distribution path matter more than global edge caching. If you have compliance reasons to keep app payloads off a public CDN, this is a welcome option.


Microsoft (Intune, Windows 365, AVD, FSLogix, Windows, Entra ID)


Remote Help is now free in E5, so what can it actually do

With Intune Suite folding into E5, a lot of people suddenly have Remote Help without realising it. Simon Skotheimsvik published a proper deep dive on August 14 on what Remote Help gives you now that it is included, which is worth a read before you go buying a third-party remote control tool you may no longer need.


Automating Win32 apps and the WAM change in the Graph SDK

Two from Ben Whitmore worth bookmarking if you live in Graph. First, an ultimate guide (August 16) to creating a Win32 app in Intune with PowerShell and Microsoft Graph, which is unexpectedly fiddly once you get behind the scenes. Second, from August 9, a clear explanation of the new WAM (Web Account Manager) broker option in the Microsoft Graph PowerShell SDK and what actually changed when you connect. If a recent script started prompting differently, that is your answer.


Azure Image Builder for AVD, in two parts

If you are still hand-building AVD golden images, Michael Meier started a nice series on moving to Azure Image Builder: Part 1 (August 9) on the pipeline itself, and Part 2 (August 16) on baking applications into the image. This is the modern, repeatable way to do AVD images, and the series is a good on-ramp.


Smaller but useful: Device Action Status, Edge extension monitoring, Delivery Optimization

A few practical ones. Craig Camacho dug into the new Intune Device Action Status (August 14), which finally gives you visibility into the black box behind the Sync button. Jorgen Nilsson showed how to monitor Edge extensions with the free Edge Management UI, which, given browser extensions are becoming the new 2000s toolbars, is more relevant than it sounds. And Microsoft's own team put out a pair of posts on Delivery Optimization, one on collecting DO logs the easy way and one on why you should configure it at all to save bandwidth on deployments.


The passwordless migration playbooks are piling up

Last time I covered Microsoft's SMS and voice MFA retirement and Roy Klooster's passkey migration piece. I am not going to re-run the deadline, but the community has spent the last fortnight writing the field guides, and they are good: Kenneth van Surksum's From IST to SOLL on modernizing your whole Entra auth flow (August 14), Jon Towles on getting ready to ditch legacy auth and go passkey-first (August 11), and Rahul Jindal on what passwordless means for your zero trust journey. If the MFA retirement is on your plate, these are three practical routes through it.


Hardware & endpoints (10ZiG, IGEL, thin clients)


IGEL Managed Containers reaches GA, and a Tap-to-App story with ControlUp

Catch-up from early in the window (August 3, so flagged honestly): IGEL Managed Containers reached general availability, extending the immutable, managed IGEL model out to containerised edge workloads. In the same week IGEL and ControlUp published a joint Tap-to-App piece on cutting clinician login friction in healthcare, which is squarely in my world and a decent read if you run shared clinical endpoints.


Samsung Knox E-FOTA, end to end with Intune

For anyone managing Samsung fleet, Nicky De Westelinck wrote a complete configuration guide (August 11) for integrating Samsung Knox E-FOTA with Intune, which is the clean way to control Samsung firmware updates from the same console as everything else.


Performance testing, tooling, DEX


Login Enterprise goes agentic: self-healing tests on Windows 365 for Agents

The one that made me sit up. On August 19 Login VSI announced Login Enterprise for Windows 365 for Agents, and it is more interesting than the usual we support the new SKU post. Instead of brittle, hardcoded UI scripts, Login Enterprise now drives Cloud PCs with a computer-using agent that interacts with apps the way a person does, using AI vision. When an application's interface shifts, the agent recognises the change, finds the element another way, and rewrites the test on its own, recording what it changed and why. Crucially it keeps a human in the loop by design: cosmetic drift gets self-healed silently, but when something is genuinely broken the agent stops (instead of looping and running up Cloud PC cost) and hands you the evidence, the final screen, everything it tried, and where it gave up. It also validates the agent and RPA workloads themselves, and it all stays inside your existing Entra and Intune governance. Full disclosure: I have not seen this in action myself yet, so I am going on the announcement here, but if you have ever had a whole Login VSI run collapse because a vendor moved a button, this is aimed squarely at that pain, and it sounds very much like the next step for continuous testing. On my list to actually try.


Community & fun


Hunting the AI agents already running in your estate

The genuinely novel one this time. Dustin Gullett wrote up how to use Microsoft Defender for Endpoint to discover local AI agents running across your devices, which, in a world where half the software you own is quietly sprouting an agent, is a very timely bit of visibility. He also did a deep dive on the Intune Vulnerability Remediation agent and what it actually does with your E5 Security Compute Units. Worth a look if you are trying to work out whether the agent hype earns its keep.


Credit where it is due

As ever, a big chunk of the endpoint and identity finds above came via Andrew Taylor's Intune newsletter, which ran every week I was away (August 7, 14 and 21) and remains the single most reliable place to catch what the endpoint community is shipping. If you only subscribe to one newsletter in this space, make it that one.


As always, if I missed something in your corner of the EUC world, or you reckon I called something wrong, drop a comment below. That is honestly how these get sharper.


This roundup is put together by "virtual me", an AI workflow powered by Claude that scans the EUC world so I do not have to live inside forty browser tabs. The robot gathers and drafts, but I read every line before it ships, and any question I raise while reviewing gets chased down and folded back in. This one is a bit different: I have been off on holiday for three weeks, so instead of the usual seven day window this is a catch-up covering everything that moved from August 5 to today. Voice is mine, sign-off is mine, the AI just carried the buckets while I was traveling the beautiful nature in Iceland with my family.


References


NetScaler CVE-2026-19490 and CVE-2026-19489 security bulletin (Citrix CTX696939): https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html

Microsoft Entra memberOf retirement (Driek Desmet): https://blog.interian.be/2026/08/18/microsoft-entra-memberof-retirement/

Windows 365 User Settings retirement, migrate now (Dieter Kempeneers): https://kempeneers.eu/2026/08/08/windows-365-user-settings-are-being-retired-migrate-now/

NetScaler Performance Impact for Post-Quantum Cryptography (Julian Jakob): https://www.julianjakob.com/netscaler-performance-impact-for-post-quantum-cryptography-pqc/

Omnissa Horizon 8 2606 and App Volumes 2312.2 release notes (Releasebot, Omnissa): https://releasebot.io/updates/omnissa

Intune Remote Help deep dive now included in E5 (Simon Skotheimsvik, MSEndpointMgr): https://msendpointmgr.com/2026/08/14/intune-remote-help-the-deep-dive-now-that-its-included-in-your-e5/

Creating a Win32 App in Intune with PowerShell and Graph (Ben Whitmore, MSEndpointMgr): https://msendpointmgr.com/2026/08/16/win32-app-intune-powershell-graph/

Microsoft Graph SDK WAM changes (Ben Whitmore, MSEndpointMgr): https://msendpointmgr.com/2026/08/09/microsoft-graph-sdk-wam/

Edge management service extension monitoring (Jorgen Nilsson, CCMEXEC): https://ccmexec.com/2026/08/edge-management-service-extension-monitoring/

From IST to SOLL, modernizing Entra ID authentication (Kenneth van Surksum): https://www.vansurksum.com/2026/08/14/from-ist-to-soll-a-field-guide-to-modernizing-entra-id-authentication/

Microsoft Entra makes passwordless and zero trust (Rahul Jindal): https://rahuljindalmyit.blogspot.com/2026/08/microsoft-entra-makes-passwordless.html

IGEL Managed Containers reaches general availability (IGEL): https://www.igel.com/blog/igel-managed-containers-secure-edge/

Announcing Login Enterprise for Windows 365 for Agents (Login VSI): https://www.loginvsi.com/resources/blog/announcing-login-enterprise-for-windows-365-for-agents/

Discover local AI agents with Microsoft Defender for Endpoint (Dustin Gullett): https://zerototrust.tech/discover-local-ai-agents-microsoft-defender-endpoint/

Intune Vulnerability Remediation agent, what it really does (Dustin Gullett): https://zerototrust.tech/intune-vulnerability-remediation-agent-what-it-really-does/

Intune Newsletter 7th August 2026 (Andrew Taylor): https://andrewstaylor.com/2026/08/07/intune-newsletter-7th-august-2026/

Intune Newsletter 14th August 2026 (Andrew Taylor): https://andrewstaylor.com/2026/08/14/intune-newsletter-14th-august-2026/

Intune Newsletter 21st August 2026 (Andrew Taylor): https://andrewstaylor.com/2026/08/21/intune-newsletter-21st-august-2026/

Opmerkingen

Post: Blog2_Post
bottom of page