Why this week mattered: AI governance took center stage in the EUC world this week — Omnissa built its whole fall conference around securing unsanctioned AI agents on managed endpoints, and ControlUp shipped two AI-powered ops tools while publishing its own “shadow AI” warning piece. Meanwhile Microsoft kept pushing zero-touch provisioning forward (Autopilot device association, Windows 365 bulk Cloud PC provisioning) and Citrix disclosed a critical, actively-scrutinized NetScaler auth-bypass that anyone running Gateway or AAA virtual servers needs to check now, not later.

Omnissa (Workspace ONE / Horizon)

• Omnissa ONE 2026 set for Sept 28–30 in Orlando, themed around securing AI agents. Omnissa is framing its flagship conference around AI governance on managed endpoints, citing internal research that 75% of enterprise-managed devices already have unsanctioned AI tools installed. NVIDIA, Nutanix, Google, AWS, IGEL, and Red Hat are sponsoring.
• Workspace ONE UEM 2607 ships eight new features. Highlights include MQTT-based real-time printer management, Apple Declarative Device Management for OS updates, a lighter macOS “Registered Mode” for BYOD/contractor devices, an upgraded full-page Omni Assistant console, Windows step-up enrollment without re-enrolling, and a new “Freeze Mode” to pause device management actions on demand.

Microsoft (Intune / Windows 365)

• Windows Autopilot device association reaches GA. Admins can now cryptographically bind a device to their tenant via TPM attestation before enrollment starts, enabling device renaming and a customized OOBE earlier in the provisioning flow. This shipped alongside Remote Help’s new unattended-access mode (RBAC-gated, credential-based sign-in for after-hours maintenance without a user present) and macOS 27+ improvements.
• Windows 11 version 26H2 moves to the Release Preview Channel. Shipping as an enablement package rather than a full reinstall, 26H2 switches on previously-delivered features (Windows settings backup, taskbar app actions, File Explorer updates) for commercial validation .

Citrix

• Critical NetScaler auth-bypass and memory-overflow CVEs. CVE-2026-19490 (CVSS 9.3, authentication bypass via an alternate path on Gateway/AAA virtual servers using SAML actions) and CVE-2026-19489 (CVSS 8.8, memory overflow when SIP ALG is enabled on LSN groups) were disclosed the week prior, but exploitation-risk warnings kept circulating through this week
• UniconOS gets dual boot for instant endpoint recovery. Citrix UniconOS Release 7 2607 now runs a hardened, isolated recovery OS alongside Windows on the same disk. If ransomware, a bad patch, or corruption takes out Windows, users boot straight into the UniconOS partition and reconnect to their apps via Citrix DaaS/Secure Private Access within minutes.

IGEL

• IGEL certifies Teguar as an “IGEL Ready” hardware partner. The partnership extends IGEL OS onto rugged, medically-certified, and AI-capable endpoints built for hospitals, manufacturing floors, defense sites, and clean rooms — useful if you’re building Zero Trust deployments where hardware durability and an immutable OS both matter.

ControlUp

• ControlUp launches Pulse Assistant, a conversational AI layer over Pulse AI. It lets IT correlate telemetry across tools and take governed remediation actions from a single natural-language interface, cutting down the console-switching that eats up troubleshooting time.
• New AI Ticket Analyzer mines service desk data for actionable patterns. The feature is aimed at reducing manual triage in ITSM workflows by surfacing patterns in ticket data and automating follow-up actions.