Microsoft fixes 1,093 November vulnerabilities, including actively exploited Outlook flaw

Microsoft fixed 1,093 security vulnerabilities in its November Patch Tuesday release on Nov. 10, 2026 across Windows and supported software, including 63 critical flaws and one actively exploited zero-day in Outlook.

Only one November flaw is under active attack, tracked as CVE-2026-124194, a spoofing issue in Microsoft Outlook, Microsoft says. Microsoft assigns the flaw a moderate rating and a CVSS score of 6.5. It affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.

An attacker sends a malicious Office file; opening it can make Outlook connect to an attacker-controlled network location and leak the user’s NTLMv2 hash, a Windows authentication credential. Attackers could use the stolen hash in an NTLM relay attack or crack it to recover the user’s password.

Microsoft’s advisory confirms detected exploitation, though it provides no details about the attacks and names no threat actors. Microsoft credited researcher nono and Benoît Sevens with the discovery, and Sevens’ acknowledgment mentioned Anthropic’s Claude AI model.

Five critical vulnerabilities carry CVSS scores of 9.8. Microsoft has not said these five vulnerabilities rated 9.8 are actively exploited. Remote code execution is possible in nearly half of the critical flaws. Across the November flaws, 535 let an attacker elevate privileges on a vulnerable device.

The CVE-2026-119958 flaw is a Windows LDAP remote code execution issue. An attack on the Windows LDAP flaw through a domain controller could expose an entire organization’s domain. CVE-2026-116928 is a Windows Search remote code execution flaw that attackers can trigger through Microsoft Exchange Server using a malicious e-mail attachment. Exchange Server also received a critical fix, CVE-2026-118207, scored at 8.8.

CVE-2026-119990 is an Azure OpenAI elevation-of-privilege flaw that permits unauthenticated access to orchestration information. CVE-2026-114160 is an elevation-of-privilege flaw in Azure Managed Grafana. CVE-2026-112967 is a remote code execution flaw in the Windows Xbox Live Networking Service. Microsoft patched remote code execution flaws in Excel, Word, PowerPoint and Outlook, some with CVSS scores of 8.8.

Windows Message Queuing received five critical remote code execution patches, while Hyper-V got eight critical elevation-of-privilege updates. Critical fixes also covered Windows Schannel, TCP/IP, the Print Spooler and network device discovery services. Windows accounts for 726 of the November flaws. Office follows with 174, SQL Server with 59, developer tools with 53, SharePoint Server with 27, Azure with 20, and Exchange Server with nine.

Microsoft republished 165 third-party CVEs in the November release and noted that Chrome vulnerabilities are not listed. November’s total falls short of October’s record of 1,413 vulnerabilities.

Its security patch total for 2026 has passed 5,100, Microsoft said. Microsoft pushed more than 1,400 fixes last month. Roughly one year ago, Microsoft averaged about 100 patches per month. Microsoft credits artificial intelligence advances for helping it identify and patch a large volume of security bugs recently.

Adobe patched at least 110 vulnerabilities across nine products and rated nearly half of them high severity. Adobe stated that no evidence shows this month’s addressed security holes are under active exploitation.

Apple issued out-of-cycle security updates on Monday for at least nine vulnerabilities in iOS, iPadOS, macOS, watchOS and visionOS. Apple’s updates patch an iMessage flaw that lets a remote attacker enter a group chat and see its messages, plus another flaw that lets someone added to a group read prior messages.

Lee Neely, an instructor at the SANS Institute, said Apple also fixed iOS 18. “I take notice when Apple releases fixes to more than two versions,”

Google released Chrome version 157.0.8103.50 with fixes for nine security holes, including CVE-2026-125350, the sixth Chrome zero-day this year. The new Chrome version comes after a November 3 release that fixed 213 vulnerabilities. Mozilla Firefox 160 addresses nearly 100 CVEs, and roughly half carry high severity ratings.

Chris Goettl of Ivanti said roughly 95,000 vulnerabilities received CVEs this year across all vendors, but only 217 reached CISA’s Known Exploited Vulnerabilities list. Goettl said about 40 percent of this year’s exploited vulnerabilities affect operating systems, endpoint software, browsers and server platforms. Goettl said 44 percent of this year’s exploited vulnerabilities sit in edge devices, including IT management and remote access tools.

Jake Knott, head of threat intelligence at watchTowr, said administrators should begin with internet-exposed assets, move to already-exploited vulnerabilities, and address everything else last. “Start with what you actually have exposed to the Internet, then what’s already being exploited in the wild, and only then everything else,”

Devices running Enterprise and Education editions of Windows 11 version 23H2 will receive no further monthly security updates. The Windows 10 KB5131096 extended security update includes November 2026 Patch Tuesday fixes, moving Windows 10 to build 19045.7846 and Windows 10 Enterprise LTSC 2021 to build 19044.7846.

BleepingComputer reports that this month’s Patch Tuesday fixed 1,235 vulnerabilities across Microsoft’s products. SecurityWeek reports that the November release fixed 1,094 vulnerabilities.