Patch Tuesday November 2026 – 1093 CVE

On 10 November 2026, Microsoft released its monthly security updates. The CVRF (1) document of the MSRC (2), referenced 2026-Nov and dated the same day at 08:00, announces 1,094 Microsoft CVEs (3). The Security Update Guide export filtered on 10 November lists 1,093, all assigned by Microsoft acting as CNA (4): the difference of one corresponds, in the CVRF document, to a CVE in the third-party Tencent RapidJSON library published the same day for Azure Linux. This article uses the scope of the export, namely 1,093 vulnerabilities.

Only one vulnerability is flagged “Exploitation Detected”: CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook, rated Moderate, which discloses the user’s NTLM (5) authentication hash, in its NTLMv2 form. No vulnerability is declared publicly disclosed before the fix. The US agency CISA (6) added CVE-2026-124194 to its KEV (7) catalogue on 10 November, with a remediation deadline of 24 November 2026 for US federal agencies.

The release counts 63 Critical vulnerabilities, 1,029 Important and one Moderate. It covers Windows, Office, SQL Server, SharePoint Server, Exchange Server, developer tools, Microsoft Defender and several Azure services. It comes one month after the October 2026 record, when Microsoft fixed 1,413 vulnerabilities, and two months after September’s 974.

Elevation of privilege accounts for nearly half of the vulnerabilities fixed, remote code execution for a little over a quarter. The 63 Critical vulnerabilities break down into 48 remote code execution and 15 elevation of privilege flaws.

Fig. 1. Breakdown by impact of the 1,093 vulnerabilities published on 10 November 2026, calculated from the Security Update Guide export and cross-checked against the CVRF document 2026-Nov.

Fig. 2. Breakdown by product family according to the MSRC release notes, on the scope of 1,094 CVEs announced by Microsoft.

Fig. 3. Distinct vulnerabilities per Windows version, calculated from the Security Update Guide export; a CVE is counted in every version it affects.

The most affected components are Word, with 65 vulnerabilities, Excel with 64, SQL Server with 53 under that tag, Windows Advanced Rasterization Platform with 37, Windows Installer with 36, the Windows graphics kernel with 35 and the Windows kernel with 28. The two Windows DNS tags, Windows DNS and Role: DNS Server, total 33 vulnerabilities.

Microsoft announced in May 2026, on the MSRC blog, that its monthly releases would keep growing, as vulnerability research becomes faster and broader across the industry. Asked about the September releases, Satnam Narang of Tenable noted that the number of vulnerabilities fixed is rising without a matching rise in the number of vulnerabilities likely to affect most organisations.

CVE-2026-124194 is a spoofing vulnerability in Microsoft Office Outlook, classified under CWE (10) 356, a user interface that does not warn of an unsafe action. An unauthenticated attacker sends a specially crafted message file and convinces the user to open it. Outlook then connects to an attacker-controlled network location without displaying the usual external content warning, which discloses the user’s NTLMv2 hash. The attacker can then use it to authenticate as the user.

Fig. 4. CVE-2026-124194 record, taken from the rendered Security Update Guide page, the CVRF document and CISA’s KEV catalogue in version 2026.11.10.

Exploitation status

• Microsoft declares exploitation detected, without naming any actor or victim or giving any indication of scale
• CISA added the CVE to the KEV catalogue on the day of release, under the name of a missing user interaction for potentially unsafe action vulnerability, and refers to its directive BOD (13) 26-04 for the required action
• the catalogue field on ransomware campaign use reads “Unknown”
• no indicator of compromise had been published by Microsoft or CISA at the time of writing

Measures

Microsoft publishes neither a workaround nor a mitigation for this CVE: the Office update is the only documented remedy. The usual measures against NTLM hash leakage remain useful as a complement: blocking outbound SMB (14) traffic to the Internet, in particular on TCP (15) port 445, restricting outbound NTLM traffic through Group Policy, and adding privileged accounts to the Protected Users group, which removes NTLM authentication from them.

The cumulative update for Windows 11, versions 25H2 and 26H2, published as KB (16) 5132061, enables by default on the client side the offer of NTLM message signing for non-anonymous connections. Microsoft presents this change as reducing exposure to NTLM relay, together with auditing of connections that do not sign. The release notes do not link it to CVE-2026-124194.

None of the 63 Critical vulnerabilities is exploited or publicly disclosed. Five are assessed “Exploitation More Likely”: CVE-2026-118146 and CVE-2026-118148 in Active Directory Domain Services, CVE-2026-118207 in Exchange Server, CVE-2026-119952 in Schannel and CVE-2026-113862 in Windows Network Address Translation.

Windows network services reachable without authentication

Twelve remote code execution vulnerabilities carry a score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N: network attack, low complexity, no privileges and no interaction. Only three are rated Critical by Microsoft; the other nine, including those in the DNS server, the DHCP server and the iSCSI (17) initiator, are rated Important.

Fig. 5. Remote code execution vulnerabilities scored 9.8 with the vector AV:N/AC:L/PR:N/UI:N, according to the CVRF document 2026-Nov. All are assessed “Exploitation Less Likely”.

CVE-2026-116928 deserves a careful reading: it concerns a Windows component, but Microsoft describes its exploitation through Exchange Server, which automatically indexes received attachments. A single email is enough, with no action from the recipient. The fix is delivered by the server’s Windows cumulative update, not by the Exchange update.

Active Directory and Kerberos

• CVE-2026-118146, Critical, 8.8, “Exploitation More Likely”: an authenticated attacker with low-level access sends a crafted request and executes code on the server, without interaction; incorrect authorisation, CWE-863
• CVE-2026-118148, Critical, 7.5, “Exploitation More Likely”: elevation to SYSTEM privileges, conditional on winning a race condition
• CVE-2026-85844, Important, 9.8: an unauthenticated attacker relays to a domain controller a Kerberos authentication obtained through crafted traffic, and gains SYSTEM privileges on that controller; authentication bypass using an alternate path or channel, CWE-288

Exchange Server and SharePoint Server

Exchange Server has nine vulnerabilities, all in the Subscription Edition only. CVE-2026-118207, Critical, 8.8, “Exploitation More Likely”, allows an authenticated attacker with low-level access to execute code on the server through a crafted request. SharePoint Server has 27 vulnerabilities, all Important and all in the Subscription Edition; the highest, CVE-2026-120002, scored 9.9, allows a user with read access who is a member of the relevant Secure Store target application to make SharePoint perform unauthorised actions on a connected business service, using the shared credentials.

Office and the Preview Pane

Office totals 22 Critical remote code execution vulnerabilities: 12 in Excel, 4 in Word, 3 in Outlook, 2 in Office and one in PowerPoint. For eight of them, Microsoft states that the Preview Pane is an attack vector: CVE-2026-110067, CVE-2026-111285 and CVE-2026-124185 in Word, CVE-2026-110068, CVE-2026-111309 and CVE-2026-110043 in Outlook, CVE-2026-111289 and CVE-2026-120003 in Office. For the twelve Critical Excel vulnerabilities, Microsoft states that the Preview Pane is not an attack vector. Eighteen of the 22 Critical Office vulnerabilities also affect Office for Mac, and eleven of the twelve in Excel affect Office Online Server, which renders workbooks server-side: the latter must be included in the deployment scope.

Hyper-V and other critical components

Hyper-V has eight Critical elevation of privilege vulnerabilities, six of them with a scope change (S:C), which for Hyper-V indicates an impact beyond the originating virtual machine. The other Critical Windows vulnerabilities concern Message Queuing (five), the graphics kernel (two), Schannel, CredSSP (19), RPC (20), IIS (21), Windows Deployment Services, the print spooler, the TCP/IP (22) stack, Network Address Translation, the SMB server transport driver, Function Discovery, the Network Connected Devices Auto-Setup Service, the TPM (23), Remote Desktop Services, fonts, the Raw Image codec and the codecs library. CVE-2026-122194, Critical, concerns the Microsoft Defender engine.

Other vulnerabilities scored 9 or above

Eleven other vulnerabilities reach a score of 9 to 9.9. All are rated Important, except CVE-2026-119990, Critical, and all are assessed “Exploitation Less Likely”, except CVE-2026-109467 and CVE-2026-119990, which carry no assessment.

Fig. 6. Vulnerabilities scored 9 to 9.9 other than those in the previous figure, according to the FAQs in the CVRF document 2026-Nov.

CVE-2026-120779 targets developer workstations: the vector runs through a remote MCP server to which the user connects their editor. CVE-2026-114162 concerns an online service, but its record states that customer action is required; an inventory of the applications holding directory role management permissions is the prerequisite.

Cloud services with no customer action

CVE-2026-119990 in Azure OpenAI, Critical, 9.8, has already been fully remediated by Microsoft: the record states that no action is expected from users, the CVE being published for transparency. CVE-2026-114160 in Azure Managed Grafana, Critical, is an SSRF (25) that disclosed a service access token. CVE-2026-109467 in Azure DevOps Server, scored 9.9, concerns by contrast a product installed on the customer’s premises: an attacker holding the Project Reader role can trigger a pipeline run and execute code on the agents.

Microsoft assesses 42 vulnerabilities as “Exploitation More Likely”. Apart from the five Critical ones cited above, almost all are local elevation of privilege flaws, of the kind an attacker chains after initial access.

Fig. 7. Vulnerabilities assessed “Exploitation More Likely”, excluding the five Critical ones, according to the CVRF document 2026-Nov.

The Windows vulnerabilities are all fixed by each version’s cumulative update. The numbers below are those of the Security Update Guide export, used for the majority of CVEs in each version.

Fig. 8. November 2026 updates by version, according to the Security Update Guide export and the KB5132061 and KB5132043 release notes. For Microsoft 365 Apps, the build depends on the update channel.

SQL Server

For SQL Server, Microsoft publishes one update per servicing branch, to be chosen from the installed version number. A GDR (27) update carries only security fixes and critical fixes, while a CU (28) update rolls up all the fixes of the branch. Updates labelled CU+GDR apply to the cumulative update branch indicated; those labelled RTM+GDR apply to the branch stemming from the product’s initial release, known as RTM (29), which receives GDRs only.

Fig. 9. November 2026 SQL Server updates, according to the FAQ for CVE-2026-116945 in the CVRF document 2026-Nov.

The order below combines exploitation status, network exposure and the system’s position in the infrastructure. It does not replace each organisation’s own inventory: a component absent from the estate drops off the list.

Fig. 10. Proposed deployment order based on the CVRF document 2026-Nov and CISA’s KEV catalogue.

The counts, severities, scores, exploitability assessments and FAQs come from the MSRC CVRF document 2026-Nov, read in full, and from the Security Update Guide export; the CVE-2026-124194 record was reread on the rendered Security Update Guide page. The KEV status comes from the JSON (30) feed of CISA’s catalogue, version 2026.11.10. The press is used for cross-checking and context.

1. CVRF (1): Common Vulnerability Reporting Framework, machine-readable document format in which Microsoft publishes all of its security advisories each month.
2. MSRC (2): Microsoft Security Response Center, Microsoft’s security response centre, publisher of the Security Update Guide.
3. CVE (3): Common Vulnerabilities and Exposures, public identifier assigned to a vulnerability.
4. CNA (4): CVE Numbering Authority, organisation authorised to assign CVEs and publish their records.
5. NTLM (5): NT LAN Manager, Windows challenge-response authentication protocol; NTLMv2 is its second version.
6. CISA (6): Cybersecurity and Infrastructure Security Agency, the US cybersecurity and infrastructure security agency.
7. KEV (7): Known Exploited Vulnerabilities, CISA’s catalogue of vulnerabilities whose exploitation has been observed.
8. DNS (8): Domain Name System, the domain name resolution system.
9. DHCP (9): Dynamic Host Configuration Protocol, protocol for the automatic assignment of network configuration.
10. CWE (10): Common Weakness Enumeration, classification of software weaknesses.
11. CVSS (11): Common Vulnerability Scoring System, system for rating the severity of vulnerabilities.
12. LTSC (12): Long-Term Servicing Channel, long-term servicing channel for the perpetual versions of Office.
13. BOD (13): Binding Operational Directive, CISA directive binding on US federal agencies.
14. SMB (14): Server Message Block, Windows file and printer sharing protocol.
15. TCP (15): Transmission Control Protocol, Internet transport protocol.
16. KB (16): Knowledge Base, Microsoft’s knowledge base; the article number identifies an update.
17. iSCSI (17): Internet Small Computer System Interface, protocol for block-level storage access over the network.
18. LDAP (18): Lightweight Directory Access Protocol, directory access protocol, used by Active Directory.
19. CredSSP (19): Credential Security Support Provider, security provider that delegates credentials, in particular for Remote Desktop.
20. RPC (20): Remote Procedure Call, remote procedure call mechanism.
21. IIS (21): Internet Information Services, the Windows web server.
22. IP (22): Internet Protocol, Internet addressing protocol.
23. TPM (23): Trusted Platform Module, hardware security component that stores keys and measures boot integrity.
24. MCP (24): Model Context Protocol, protocol that connects an artificial intelligence assistant or a code editor to external tools and data sources.
25. SSRF (25): Server-Side Request Forgery, vulnerability that makes a server send a request to a destination chosen by the attacker.
26. WMI (26): Windows Management Instrumentation, Windows administration and monitoring interface.
27. GDR (27): General Distribution Release, SQL Server update limited to security fixes and critical fixes.
28. CU (28): Cumulative Update, SQL Server cumulative update carrying all the fixes of its branch.
29. RTM (29): Release To Manufacturing, initial release of a product, starting point of its GDR branch.
30. JSON (30): JavaScript Object Notation, structured data interchange format.
31. ZDI (31): Zero Day Initiative, TrendAI’s vulnerability acquisition and coordinated disclosure programme.

1. Microsoft MSRC, November 2026 Security Updates, release notes, 10 November 2026. msrc.microsoft.com/update-guide/releaseNote/2026-Nov
2. Microsoft MSRC, CVRF document 2026-Nov, version 1.0, 10 November 2026. api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Nov
3. Microsoft MSRC, Security Update Guide export filtered on 10 November 2026, file Security_Updates_2026-11-10. msrc.microsoft.com/update-guide
4. Microsoft MSRC, CVE-2026-124194, Microsoft Outlook Spoofing Vulnerability, 10 November 2026. msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194
5. CISA, Known Exploited Vulnerabilities Catalog, version 2026.11.10, 10 November 2026. cisa.gov/known-exploited-vulnerabilities-catalog
6. Microsoft Support, November 10, 2026, KB5132061 (OS Builds 26300.9974, 26200.9974 and 26100.9974), 10 November 2026. support.microsoft.com/help/5132061
7. Microsoft Support, November 10, 2026, Hotpatch KB5132043, 10 November 2026. support.microsoft.com/help/5132043
8. Microsoft MSRC, A note on this month’s Patch Tuesday, May 2026. microsoft.com/en-us/msrc/blog
9. Microsoft .NET Blog, Rahul Bhandari, .NET 8 and .NET 9 will reach End of Support on November 10, 2026, 29 June 2026. devblogs.microsoft.com/dotnet
10. Cyber Security News, Guru Baran, Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities, Including Outlook Zero-Day, 10 November 2026. cybersecuritynews.com
11. Le Crabe Info, Windows 11 KB5132061 : le Patch Tuesday de novembre 2026 est disponible, 10 November 2026, in French. lecrabeinfo.net
12. WindowsCult, Windows 11 KB5132061 November 2026 Update, 10 November 2026. windowscult.com
13. SecurityWeek, Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day, October 2026. securityweek.com
14. SecurityWeek, Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days, September 2026. securityweek.com
15. TrinetriOps, Microsoft Patch Tuesday November 2026, page consulted on 10 November 2026, cited for the discarded data point. trinetriops.com