Microsoft’s November 2026 Patch Tuesday: 1,093 Vulnerabilities, 63 Critical Fixes, and an Outlook Threat

Microsoft's November 2026 Patch Tuesday has delivered another substantial security update, addressing 1,093 vulnerabilities across Windows, Office, Exchange Server, SQL Server, SharePoint, Azure, and other Microsoft products. Released on November 10, the updates include 63 Critical, 1,029 Important, and one Moderate vulnerability, highlighting the extensive range of security weaknesses affecting enterprise environments.

The most significant concern this month is CVE-2026-124194, an actively exploited zero-day vulnerability in Microsoft Outlook that could allow attackers to steal NTLMv2 authentication hashes. Despite receiving a Moderate severity rating and a CVSS score of 6.5, its confirmed exploitation makes it one of the highest-priority fixes in this release.

Beyond the zero-day, Microsoft has addressed several critical remote code execution (RCE) and elevation of privilege (EoP) vulnerabilities affecting essential Windows services, Active Directory, Exchange Server, and other widely deployed components. The sheer volume of vulnerabilities, combined with their potential impact on enterprise infrastructure, makes timely patching particularly important.

November 2026 Patch Tuesday: Vulnerability Breakdown

Of the 1,093 vulnerabilities addressed, 535 are elevation of privilege flaws, representing nearly half of the release. Remote code execution follows with 296 vulnerabilities, while information disclosure accounts for another 156. The remaining vulnerabilities involve denial of service, security feature bypass, spoofing, and tampering.

Breakdown by vulnerability type

Elevation of privilege vulnerabilities dominate this month's release, accounting for approximately 48.9% of the total. Such flaws can allow attackers who already possess limited access to obtain higher permissions, potentially compromising sensitive data or gaining control over affected systems.

Remote code execution vulnerabilities represent approximately 27.1% of the fixes and present significant risks, particularly when network-accessible services are involved. Successful exploitation could allow attackers to execute arbitrary code on vulnerable systems, potentially resulting in system compromise or lateral movement within enterprise networks.

Breakdown by severity

Among the 63 Critical vulnerabilities, 48 involve remote code execution and 15 involve elevation of privilege. While most vulnerabilities are rated Important, the actively exploited Outlook flaw demonstrates why exploitation status must be considered alongside severity ratings when prioritizing security updates.

Most Notable Vulnerabilities

1. CVE-2026-124194: Microsoft Outlook Spoofing Zero-Day

Severity: Moderate | CVSS: 6.5 | Status: Actively Exploited

The most urgent vulnerability addressed this month is CVE-2026-124194, an actively exploited spoofing flaw in Microsoft Outlook.

The vulnerability stems from Outlook failing to display an appropriate warning before potentially unsafe actions occur. An unauthenticated attacker could craft a malicious message file and convince a victim to open it in Outlook. This action could cause the application to connect to an attacker-controlled network location without displaying the expected external-content warning.

During this connection, the victim's NTLMv2 authentication hash may be disclosed, potentially enabling attackers to impersonate the affected user or attempt further attacks against enterprise resources.

Exploitation requires user interaction and network connectivity, and Microsoft has confirmed that the Preview Pane alone is not an attack vector. Although the vulnerability has a relatively low CVSS score compared with other flaws in this release, confirmed exploitation makes remediation a priority.

2. CVE-2026-119958: Windows LDAP Remote Code Execution Vulnerability

Severity: Critical | CVSS: 9.8 | Exploitability: Exploitation Less Likely

CVE-2026-119958 is a critical remote code execution vulnerability affecting the Windows Lightweight Directory Access Protocol (LDAP) implementation.

LDAP plays an essential role in directory services and authentication infrastructure, particularly in Active Directory environments. A successful attack against a vulnerable LDAP service could potentially enable remote code execution, threatening the confidentiality and integrity of affected systems.

With a CVSS score of 9.8, this vulnerability deserves particular attention from organizations operating Windows domain infrastructure. Although Microsoft considers exploitation less likely, the potential impact makes it an important patching priority.

3. CVE-2026-118146: Windows Active Directory Domain Services Remote Code Execution Vulnerability

Severity: Critical | CVSS: 8.8 | Exploitability: Exploitation More Likely

CVE-2026-118146 affects Windows Active Directory Domain Services (AD DS), a central component of identity and access management in enterprise environments.

The vulnerability results from improper authorization, potentially allowing an authenticated attacker to execute arbitrary code remotely on an affected system. Compromising Active Directory infrastructure can have extensive consequences because it manages authentication, permissions, and access to resources throughout a Windows domain.

Microsoft has assessed exploitation as more likely, making this vulnerability particularly relevant for organizations managing domain controllers and other critical identity infrastructure.

4. CVE-2026-118207: Microsoft Exchange Server Remote Code Execution Vulnerability

Severity: Critical | CVSS: 8.8 | Exploitability: Exploitation More Likely

This vulnerability affects Microsoft Exchange Server and could allow an authenticated attacker to execute arbitrary code remotely by submitting specially crafted malformed input.

Exchange Server frequently processes sensitive corporate communications and integrates closely with enterprise identity systems. Successful exploitation could compromise the affected server, potentially exposing email data or enabling attackers to expand their access within the organization.

Given its Critical rating and Microsoft's assessment that exploitation is more likely, organizations running vulnerable Exchange Server deployments should prioritize the corresponding security updates.

5. CVE-2026-119952: Windows Schannel Remote Code Execution Vulnerability

Severity: Critical | CVSS: 8.1 | Exploitability: Exploitation More Likely

CVE-2026-119952 is a remote code execution vulnerability in Windows Schannel, the security support provider responsible for implementing TLS and SSL functionality in Windows.

The vulnerability involves an observable timing discrepancy that could potentially be exploited by an unauthenticated remote attacker to execute arbitrary code.

Because Schannel is used by numerous Windows applications and services for secure communications, vulnerabilities affecting this component may have implications across different enterprise environments. Microsoft's assessment that exploitation is more likely further increases the need for timely remediation.

6. CVE-2026-120002: Microsoft SharePoint Server Elevation of Privilege Vulnerability

Severity: Important | CVSS: 9.9 | Exploitability: Exploitation Less Likely

CVE-2026-120002 is a high-impact elevation of privilege vulnerability in Microsoft SharePoint Server.

The flaw arises from incorrect authorization, allowing an authenticated attacker to potentially gain elevated privileges through network-based exploitation.

SharePoint is widely used for enterprise document management, collaboration, and internal information sharing. Unauthorized privilege escalation could expose sensitive organizational information or allow attackers to modify resources beyond their intended access permissions.

Despite its Important severity classification, its CVSS score of 9.9 makes it one of the highest-scoring vulnerabilities in this month's release.

Other Critical Security Fixes

Microsoft's November updates also address multiple significant vulnerabilities across its software ecosystem. These include critical flaws in Windows Hyper-V, Message Queuing, SMB Server, TCP/IP, IIS, CredSSP, Print Spooler, and Remote Procedure Call Runtime.

Cloud and security products also received important fixes, including:

• CVE-2026-119990: Azure OpenAI Elevation of Privilege Vulnerability: Critical, CVSS 9.8.
• CVE-2026-114160: Azure Managed Grafana Elevation of Privilege Vulnerability: Critical, CVSS 9.8.
• CVE-2026-122194: Microsoft Defender Remote Code Execution Vulnerability: Critical, CVSS 8.8.

Together, these vulnerabilities illustrate the breadth of the November release, spanning desktop applications, identity infrastructure, enterprise servers, cloud services, and security tools.

Affected Microsoft Products

The November 2026 Patch Tuesday security updates affect a broad range of Microsoft products and underlying components, including:

The exact affected versions vary by CVE. Administrators should refer to Microsoft's Security Update Guide to identify the applicable updates for each deployed product.

Solutions and Mitigations

Organizations should prioritize deployment of Microsoft's November 2026 security updates, beginning with the actively exploited Outlook vulnerability, followed by critical remote code execution flaws in Active Directory, Exchange Server, Windows networking services, and other exposed infrastructure. Security teams should review the Microsoft Security Update Guide, identify affected systems through asset inventories and vulnerability assessments, and deploy the relevant updates through established patch management processes. For the Outlook zero-day, restricting unnecessary outbound SMB and NTLM authentication traffic can provide additional protection against credential disclosure attempts, while user awareness measures can reduce exposure to malicious message files. Organizations should also monitor authentication activity for suspicious behavior, maintain endpoint protection and least-privilege controls, and conduct post-patch vulnerability scans to verify successful remediation. With more than a thousand vulnerabilities addressed in a single release, risk-based prioritization and continuous patch compliance monitoring remain essential for minimizing enterprise exposure.

Conclusion

Microsoft's November 2026 Patch Tuesday highlights the continued security challenges facing enterprise environments. With 1,093 vulnerabilities addressed, including 63 Critical flaws and an actively exploited Outlook zero-day, the release demands attention across endpoint, server, cloud, and identity infrastructure.

The Outlook vulnerability demonstrates that a Moderate severity rating does not necessarily indicate a low operational risk, especially when exploitation is already occurring. Meanwhile, critical flaws affecting Active Directory, Exchange Server, LDAP, and Schannel reinforce the importance of securing foundational enterprise services.

Organizations should prioritize patches according to exploitation activity, potential impact, and exposure while ensuring that vulnerable systems are identified and remediated promptly.

Instantly Fix Risks with Saner Patch Management