Microsoft November 2026 Patch Tuesday Fixes 1,093 Flaws and an Exploited Outlook Zero-Day

TL;DR

Microsoft’s November 2026 Patch Tuesday, released on November 10, addresses 1,093 vulnerabilities across Windows, Office, Azure and server products. One of them, the Outlook spoofing flaw CVE-2026-124194, was already under attack. In addition, Microsoft flagged 42 other bugs as “more likely” to be exploited.

November’s release brings one exploited zero-day, a CVSS 10.0 cloud flaw and more than a dozen bugs rated 9.8 or higher. Most of the worst issues allow remote code execution without a login. Patch Outlook first, then domain controllers, network servers and SQL Server.

Notable CVEs

Why It Matters

The November 2026 Patch Tuesday is large by any measure. Elevation of privilege bugs lead the count at 536. Remote code execution follows with 296, then information disclosure with 157. The rest include 46 denial of service, 27 security feature bypass, 22 spoofing and 11 tampering flaws.

Note that the total includes CVEs that Microsoft republished for third-party code. These include Chromium bugs and open-source packages such as OpenSSH, Perl CGI and the Linux kernel.

The Exploited Zero-Day

CVE-2026-124194 (CVSS 6.5) is a Microsoft Outlook spoofing flaw. Microsoft says the “product UI does not warn user of unsafe actions.” CISA added it to the Known Exploited Vulnerabilities catalog on November 10, with a federal deadline of November 24.

How the Attacks Work

Critical network service flaws

Five Windows network services carry CVSS 9.8 bugs that need no login. They are Kerberos (CVE-2026-85844), LDAP (CVE-2026-119958), DNS (CVE-2026-88218), DHCP Server (CVE-2026-88243) and iSCSI (CVE-2026-88234). CISA’s assessment marks each one as “Automatable.”

Server products

Meanwhile, SharePoint Server (CVE-2026-120002) and Azure DevOps Server (CVE-2026-109467) both score 9.9. SQL Server’s CVE-2026-116945 scores 9.8 and needs no authentication.

Other 9.8 bugs

Microsoft also fixed 9.8 flaws in Windows Search (CVE-2026-116928) and the Xbox Live Networking Service (CVE-2026-112967). Media Foundation, DirectMusic and Color Management received similar fixes.

Cloud issue

Finally, CVE-2026-109469 in Entra Device Registration scores a perfect 10.0. Since Microsoft runs this service, admins should check the advisory for any required steps.

Affected Versions

• Windows 10, Windows 11 and Windows Server 2012 through 2025
• Microsoft 365 Apps, Office LTSC 2021 and LTSC 2024
• SharePoint Server Subscription Edition and Azure DevOps Server 2025
• SQL Server 2017, 2019, 2022 and 2025

Patch and Mitigation

Install the November cumulative updates through Windows Update, WSUS or your patch tool. Start with Outlook, because attackers already use that bug. Next, patch domain controllers and DNS, DHCP and iSCSI servers. Then move to SharePoint, Azure DevOps Server and SQL Server. Overall, the November 2026 Patch Tuesday demands fast action on internet-facing and identity systems. The full list is in the Microsoft Security Update Guide.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.