October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities

Microsoft addressed 1,413 vulnerabilities in its October 2026 security update release, including one exploited zero-day vulnerability, two publicly disclosed zero-day vulnerabilities, and 75 Critical vulnerabilities. This month's leading risk types by exploitation technique are elevation of privilege with 677 patches (48%), remote code execution (RCE) with 317 patches (22%), and information disclosure with 254 patches (18%). Windows received the most patches this month with 1,123, followed by ESU with 977 and Microsoft Office with 179. Preview Pane-triggered exploitation dominates this release with 23 CVEs across Office applications including Excel, PowerPoint, and Visio. These flaws require minimal user interaction; a victim could simply view a malicious file in the Reading Pane or file explorer preview, eliminating the traditional click-to-compromise barrier that many enterprises rely on as a user training backstop. The attack surface is substantial; any user who receives a weaponized document via download can trigger code execution simply by selecting the file. This class of flaw has historically been attractive to phishing operators and initial access brokers because it converts document delivery into reliable code execution without requiring macro enablement or a user opening the file. Unauthenticated network-reachable RCE vulnerabilities appear across 15 CVEs this month, spanning Dynamic Host Configuration…