The EUC Weekly Roundup: July 22 to 29, 2026

Right, the week of July 22 to 29. After last week's Citrix and XenServer fireworks the vendors went a little quiet, so this week leans harder on the community: Michael Niehaus on Patch Tuesday quietly killing WSUS, Jannik Reinhard on Enterprise App Management, John Billekens with a neat vendor-neutral optimization tool, and a fresh GO-EUC benchmark. Omnissa also turned up to collect a trophy. Where something is really a continuation of last week rather than brand new, I have said so instead of dressing it up as fresh.

Security advisories and active deadlines

Broadcom drops VMSA-2026-0006: patch your ESXi and vCenter

Fresh from Broadcom on July 29: VMSA-2026-0006 addresses a batch of vulnerabilities across VMware ESX/ESXi, vCenter, Workstation and Fusion, tracked as CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703 and CVE-2026-41709. If you run VDI, this one lands squarely under your feet, because ESXi and vCenter are the floor most Horizon and Citrix estates are standing on.

I have not seen confirmed CVSS scores or the per-CVE details yet, so do not take my word on severity: pull the advisory, check the affected builds and the fixed versions, and slot it into your next maintenance window accordingly. With hypervisor CVEs the blast radius is the whole cluster, so I would not let this one sit.

Advisory: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017

Entra ID enforcement deadlines are stacking up

Two dates for the calendar. From September 7, self-service password reset will only accept authentication methods that were formally registered; directory-sourced phone numbers and emails that were never explicitly registered stop working. And Custom controls in Conditional Access retire on September 30 (full end of life in May 2027), so if you still bolt a third-party MFA provider on through Custom controls, start the move to External MFA now. Full breakdown in Microsoft's Entra ID security updates post.

Nutanix migration promo closes this week (July 31)

Flagged last week, but now it is actually here: Nutanix's limited-time migration offer, a year of free licensing plus their zero-data-migration path for supported external storage, closes July 31. If a business case has been sitting half-finished on someone's desk, this is the week it turns into a pumpkin.

ControlUp legacy Device Registration Codes expire August 31

Housekeeping for the DEX crowd: ControlUp is expiring all legacy Device Registration Codes on August 31 as it moves to a stronger code-generation algorithm. Regenerate before then, or new device onboarding quietly breaks.

Horizon 8.2212 ESB has reached end of support

For anyone still parked on an older ESB: Horizon 8.2212 hit end of general support on July 12. The current LTS is 8.2603 (supported through April 2029), with 8.2512 good until December 2028. Time to plan the hop.

Citrix / NetScaler

Quiet on the NetScaler front, and that is fine

No new Citrix or NetScaler bulletin landed this week. The live one is still CVE-2026-8451, the SAML IdP memory overread I led with last week; it remains actively exploited, so if you skipped it, last week's entry still stands: patch and rotate sessions. No news here is genuinely good news.

HyperVisor news

A calmer week after the XenServer and AVD noise

Nothing materially new since last week's XenServer 9 public preview and the AVD-on-Arc hybrid story. The one live calendar item is the Nutanix deadline up in section one. I would rather tell you it was quiet than re-serve last week's plate.

Omnissa

Omnissa named a Leader in the Forrester Wave for Endpoint Management

Fresh on July 23: Omnissa was named a Leader in The Forrester Wave: Endpoint Management Platforms, Q2 2026, picking up top-possible scores for innovation, self-healing and frontline-worker enablement. Take analyst rankings with the usual pinch of salt, but for a company barely two years out of the VMware split, topping the Wave is a decent signal that Workspace ONE still has momentum.

Hub Services picks up new admin and self-service tools

The July Hub Services update added a batch of admin tooling and new end-user self-service capabilities. Nothing earth-shaking, but worth a scan of the notes if you run Workspace ONE.

Horizon Web Client 2503.2

On the Horizon side, Web Client 2503.2 shipped as part of Horizon 8 2503.2 with tighter validation checks and Lifecycle Management workflow improvements. Incremental, but the LCM reliability fixes are welcome.

Omnissa Connect maintenance on July 31

Heads up for anyone leaning on Omnissa Connect: a maintenance window is scheduled for Friday July 31, 05:00 to 09:00 UTC, for a load balancer firmware upgrade, with around five minutes of expected downtime.

Microsoft

Windows 365 Frontline becomes Windows 365 Flex, plus Reserve and Autopilot

The naming carousel spins again: Windows 365 Frontline is now Windows 365 Flex. Alongside it, a new Windows 365 Reserve option appeared, and Autopilot device preparation is now available for Cloud PCs, pre-installing apps and scripts before a user ever signs in. Judging by the Build 2026 messaging, the whole Windows 365 story is tilting toward developers and agents.

FSLogix finally gets a proper Intune home

This is the one I am quietly pleased about. The FSLogix administrative template is now in the Intune settings catalog, so you can configure FSLogix centrally for Intune-enrolled session hosts instead of wrangling GPOs or raw registry keys. And Azure Files plus FSLogix for external identities in AVD went GA, which is handy if you host partners or vendors.

This week in Entra: jailbreak detection in Authenticator

Beyond the enforcement deadlines up in section one, the July Entra update added jailbreak and root detection in Microsoft Authenticator (secure by default, no admin config, iOS and Android), direct admin assignment of external users by email in entitlement management, and, from August, an improved iCloud-backed backup and restore for Authenticator on iOS.

Michael Niehaus: Patch Tuesday quietly broke WSUS

The community read of the week. Michael Niehaus (Out of Office Hours) flags that July's monster Patch Tuesday finally pushed WSUS over the edge: cumulative updates now pulling in hundreds of individual fixes per month is more than WSUS was built to chew on, and he and the DeployR team caught it breaking. If you are still running WSUS, treat this as your nudge that the AI-inflated patch volumes have real operational side effects. He has a companion piece on why Windows 11 just keeps getting bigger, which is the same story told from the image-size angle.

Jannik Reinhard: Enterprise App Management auto-update goes GA

Jannik Reinhard has a hands-on walkthrough of Enterprise App Management auto-update, generally available since the June service release. If you lean on EAM to keep third-party apps patched, he covers how to switch on auto-update and how it stacks up against the alternatives. Practical, admin-perspective, exactly the kind of detail vendor release notes skip.

Roy Klooster: the macOS-meets-Intune papercuts

One I missed from mid-July, worth surfacing: Roy Klooster (RK Solutions, and a Microsoft MVP for Graph) has a pair of sharp macOS-plus-Intune troubleshooting pieces from tenant experience. The July 15 one explains why OneDrive's OpenAtLogin managed preference is now a no-op on current sync builds and why a Managed Login Items profile is the actual fix, with an earlier post on why macOS LAPS passwords get rejected when an Intune compliance policy quietly forces a password change. If you manage any Macs through Intune, his write-ups are the good stuff.

Andrew Taylor's Intune newsletter is back

After taking the prior week off, Andrew Taylor's July 24 Intune newsletter is out again with the usual dense roundup, including Windows 365 Link bare-metal recovery guidance and Enterprise App Management notes. Still the fastest way to catch the small stuff I would otherwise miss.

Hardware and endpoints

10ZiG teams up with Cendio for Linux desktops

One I missed last time (July 16): 10ZiG and Cendio announced a partnership baking ThinLinc's remote-desktop tech directly into 10ZiG's PeakOS and RepurpOS, aimed at secure, high-performance access to centralised Linux desktops. If you run a Linux VDI or server-based-computing estate, this is a native end-to-end path worth a look.

IGEL: quiet on the blog, but UMS ticked forward

You asked, so: IGEL's own blog has been quiet since the Now & Next Miami recap back in May, so no fresh thought-leadership this week. The one concrete item is a maintenance release, IGEL UMS 12.12.110 on July 2 (catch-up), a routine Universal Management Suite update. If you run IGEL OS 12 at scale, skim the release notes before your next UMS bump. I will keep the IGEL blog on the watch list for when they publish something with more meat.

Performance testing, tooling and DEX

GO-EUC benchmarks Windows 11 25H2 versus 26H2

The highlight of the week for the performance nerds among us (guilty as charged): GO-EUC published an early performance comparison of Windows 11 25H2 versus the 26H2 preview on July 28, courtesy of Leee Jeffries. Full disclosure, and I mean this literally: I was the reviewer on this one for GO-EUC, so I read every number before it went live and it is now published. Biased, sure, but the methodology is solid and the data is exactly what you want before you commit to your next golden image. Pair it with Niehaus's image-size piece above and you have your 26H2 reading list.

John Billekens ships a vendor-neutral Workspace Optimizer

One I missed from early July (July 2), and a genuinely community-spirited one: John Billekens (Notes from the field) released Workspace Optimizer, a vendor-independent, open-source tool for building and editing VDI and SBC image-optimization templates straight from the browser. No agent to install, nothing sent to a server, everything stays local, and you can fork and self-host it under your own branding. With Citrix Optimizer locked behind active licensing and the Omnissa OSOT tied to that stack, a neutral option for mixed or migrating estates is exactly what was missing. Built with feedback from the AppVentiX team, and up on GitHub if you want to contribute.

Community and fun

The EUC crowd is quietly turning into the AI crowd

A pattern I cannot un-see this week: half the EUC bloggers I follow have pivoted to AI. Marius Sandbu is writing about GenAI energy use and LLM lock-in, Jannik Reinhard's front page is now mostly Microsoft Foundry agents, and, well, this very post is stitched together by an AI workflow. EUC has always been about wrangling whatever the endpoint throws at us, and right now that is agents. Whether that excites or exhausts you, it is where the community's attention has drifted. I will keep one boot in the VDI trenches regardless.

---

Housekeeping: no fresh UAG or DEM news landed this week, so nothing to report on either front.

That is the week. If I missed something you reckon belongs here, or you want me to dig deeper on any of these, drop a comment below and I will chase it down for the next one.

this roundup is compiled by 'virtual me', an AI workflow running on Claude that does the weekly legwork of trawling through vendor bulletins, blogs and release notes so I do not have to do it all by hand. The gathering is automated, but nothing ships unchecked. I review every item before it goes out, and any follow-up questions I raise get chased down and folded back into the article. So think of it as me, with a very fast and slightly obsessive research assistant.

References

Entra ID security updates and deadlines (Microsoft Tech Community): https://techcommunity.microsoft.com/blog/microsoft-entra-blog/microsoft-entra-id-security-updates-what-organizations-need-to-do-now/4522024

Nutanix VMware migration offer (Nutanix): https://www.nutanix.com/vmware-alternative

ControlUp release notes (ControlUp): https://support.controlup.com/docs/release-notes-current

Omnissa Horizon end of life dates (endoflife.date): https://endoflife.date/horizon

CVE-2026-8451 CitrixBleed echoes (CyberScoop): https://cyberscoop.com/citrix-netscaler-flaw-cve-2026-8451-citrixbleed/

Omnissa named Leader in Forrester Wave (Omnissa): https://www.omnissa.com/insights/news/Omnissa-WorkspaceONE-leader-Forrester-Wave-2026/

What's new in Hub Services July 2026 (Omnissa Community): https://community.omnissa.com/forums/topic/72756-whats-new-in-hub-services-in-july-2026

Omnissa release notes (Releasebot): https://releasebot.io/updates/omnissa

Omnissa Workspace ONE status and maintenance (Omnissa): https://status.workspaceone.com/

Windows 365 at Build 2026 (Microsoft Tech Community): https://techcommunity.microsoft.com/blog/windows-itpro-blog/made-for-developers-and-agents-windows-365-at-build-2026/4519041

What's new in Azure Virtual Desktop, incl. FSLogix settings catalog (Microsoft Learn): https://learn.microsoft.com/en-us/azure/virtual-desktop/whats-new

Windows 365 and AVD external identities GA (Microsoft Tech Community): https://techcommunity.microsoft.com/blog/windows-itpro-blog/windows-365-and-azure-virtual-desktop-support-external-identities-now-generally-/4468103

What's New in Microsoft Entra July 2026 (Microsoft Tech Community): https://techcommunity.microsoft.com/blog/microsoft-entra-blog/whats-new-in-microsoft-entra-july-2026/4534631

Still using WSUS? Patch Tuesday broke it (Out of Office Hours, Michael Niehaus): https://oofhours.com/2026/07/24/still-using-wsus-patch-tuesday-broke-it/

How can Windows 11 keep getting bigger? (Out of Office Hours): https://oofhours.com/2026/07/23/how-can-windows-11-keep-getting-bigger/

Enterprise App Management Auto-Update GA (Jannik Reinhard): https://jannikreinhard.com/intune-enterprise-app-management-auto-update/

OneDrive Open at Login on macOS (RK Solutions, Roy Klooster): https://rksolutions.nl/posts/macos-onedrive-open-at-login/

RK Solutions blog (rksolutions.nl): https://rksolutions.nl/

Intune Newsletter 24 July 2026 (Andrew Taylor): https://andrewstaylor.com/2026/07/24/intune-newsletter-24th-july-2026/

10ZiG and Cendio partnership (VMblog): https://vmblog.com/news/10zig-and-cendio-partner-to-deliver-secure-high-performance-linux-server-based-computing/

IGEL UMS 12.12.110 release notes (IGEL Community Docs): https://igel-community.github.io/IGEL-Docs-v02/Docs/ReleaseNotes/02-UMS/

GO-EUC Windows 11 25H2 vs 26H2 (GO-EUC): https://www.go-euc.com/windows-11-25h2-vs-26h2-preview-an-early-performance-comparison/

Introducing Workspace Optimizer (John Billekens, Notes from the field): https://blog.j81.nl/posts/introducing-workspace-optimizer/

Marius Sandbu blog (msandbu.org): https://msandbu.org/

Jannik Reinhard blog (jannikreinhard.com): https://jannikreinhard.com/