Microsoft's October 2026 Patch Tuesday Delivers 1,413 Fixes, Including Flaws That Can Trigger From a File Preview

Microsoft addressed 1,413 vulnerabilities in its October 2026 security update, according to CrowdStrike's analysis. The release includes one exploited zero-day, two publicly disclosed zero-days and 75 Critical vulnerabilities. Elevation of privilege flaws make up the largest share with 677 patches (48%), followed by remote code execution with 317 (22%) and information disclosure with 254 (18%).

One standout theme is Preview Pane exploitation, with 23 CVEs across Office applications including Excel, PowerPoint and Visio. These flaws need minimal user interaction: a victim could simply view a malicious file in the Reading Pane or file explorer preview. That removes the click-to-open step many organisations rely on staff training to catch. CrowdStrike notes this class of flaw has historically appealed to phishing operators and initial access brokers, because it turns document delivery into reliable code execution without needing macros or the file to be opened.

The release also contains 15 unauthenticated, network-reachable remote code execution vulnerabilities. These affect DHCP Server, Microsoft QUIC, the PostScript Printer Driver and PDF handling components, and let remote attackers run code without logging in. That makes them valuable for initial compromise and lateral movement. DHCP servers sit on internal networks by design and trust requests from any client. CVE-2026-100219 and CVE-2026-105016 in Microsoft QUIC affect any service using QUIC transport, which is increasingly common in modern web infrastructure.