Microsoft ships November Patch Tuesday fixes for more than 1,000 flaws

This is a new development in a story we reported earlier: Microsoft releases Windows 10 KB5131096 Extended security update.

Microsoft issued its November 2026 Patch Tuesday security updates on Tuesday, Nov. 10, 2026, addressing more than 1,000 vulnerabilities across Windows, Office, Exchange Server and other products and including the Windows 10 KB5131096 extended security update.

The totals do not agree. SANS ISC counts 1,260 November vulnerabilities in what it describes as an AI-induced patch surge. Tenable says Microsoft addressed 1,093 CVEs, and Redmondmag puts the total at 1,093. SecurityWeek reports 1,094 vulnerabilities, while BleepingComputer counts 1,235.

Critical ratings also split across sources. SANS ISC puts the critical count at 68 for the November vulnerabilities. Tenable’s breakdown lists 63 critical vulnerabilities, 1,029 important ones, one moderate and zero low. Redmondmag says 63 of the updates released Tuesday received a critical rating.

Tenable says the update includes patches for 287 products and components. SecurityWeek breaks the flaws down by product family: Windows accounts for 726, Office for 174, SQL Server for 59, developer tools for 53, SharePoint Server for 27, Azure for 20 and Exchange Server for 9.

SecurityWeek says Microsoft republished 165 third-party CVEs and omitted Chrome vulnerabilities from the list. Of the vulnerabilities, 167 are Chromium issues affecting Microsoft Edge, SANS ISC says.

The most pressing flaw is CVE-2026-124194. SANS ISC calls it an Outlook spoofing vulnerability already exploited. Tenable says Microsoft describes it as a zero-day exploited in the wild. Redmondmag says attackers already exploit it in the wild and could steal Windows authentication credentials through it.

SecurityWeek says Microsoft classifies CVE-2026-124194 as a spoofing flaw with moderate severity and a CVSS score of 6.5. Tenable corroborates the CVSSv3 score of 6.5 and moderate rating.

SecurityWeek says Outlook does not alert users before a potentially dangerous action, and the victim must open a malicious file. Tenable says an attacker tricks someone into opening a crafted Office file to capture a valid NTLMv2 hash. Microsoft said the Preview Pane cannot trigger the flaw and that it discloses a user’s NTLMv2 hash to an attacker. “This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user,” Microsoft said.

The vulnerability was not publicly disclosed before the fix, SecurityWeek says. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024.

Microsoft credits researcher nono and Benoît Sevens with finding the flaw, SecurityWeek says, and Sevens’ acknowledgment cites Anthropic’s Claude AI. Tenable says Microsoft’s advisory credits a researcher for using Claude, Anthropic’s large language model, but does not specify the version. Redmondmag says Microsoft credited a researcher using Claude without saying whether the discovery came before or after active exploitation.

The critical list from SANS ISC includes CVE-2026-119958, a remote code execution flaw in Microsoft LDAP. SANS ISC also flags CVE-2026-109459, CVE-2026-119967, CVE-2026-116710, CVE-2026-119963 and CVE-2026-119964 as critical flaws in Microsoft Queuing and Queue Manager. CVE-2026-113859 is a Windows TCP/IP remote code execution vulnerability scored at 7.5, according to SANS ISC.

Tenable highlights several other critical flaws. CVE-2026-118146 is a Windows Active Directory Domain Services remote code execution vulnerability with CVSSv3 score 8.8, rated critical and assessed as Exploitation More Likely. CVE-2026-118207 is a Microsoft Exchange Server remote code execution vulnerability with CVSSv3 score 8.8, rated critical and assessed as Exploitation More Likely. CVE-2026-119952 is a Windows Schannel remote code execution vulnerability with CVSSv3 score 8.1, rated critical and assessed as Exploitation More Likely.

Tenable also lists CVE-2026-120002, a Microsoft SharePoint Server elevation of privilege vulnerability with CVSSv3 score 9.9, rated important and assessed as Exploitation Less Likely. Tenable says elevation of privilege flaws account for 48.9 percent of patched vulnerabilities this month, with remote code execution flaws at 27.1 percent.

Redmondmag says five critical vulnerabilities carry Common Vulnerability Scoring System scores of 9.8. CVE-2026-119958 is one of them, a Windows LDAP remote code execution flaw. An unauthenticated attacker could run code remotely via specially crafted LDAP requests, endangering an entire domain if a domain controller is exploited. Microsoft has not reported active exploitation of these five vulnerabilities.

Redmondmag says CVE-2026-116928 is a Windows Search remote code execution flaw that Microsoft Exchange Server can trigger when a malicious email attachment is indexed automatically, and opening the attachment is not required. CVE-2026-119990 is an Azure OpenAI elevation of privilege vulnerability that could let an unauthenticated attacker access orchestration information or disrupt services. CVE-2026-114160 is an Azure Managed Grafana elevation of privilege flaw, and CVE-2026-112967 is a Windows Xbox Live Networking Service remote code execution flaw.

Other critical updates cover remote code execution vulnerabilities in Office applications including Excel, Word, PowerPoint and Outlook, several with CVSS scores of 8.8. Five critical remote code execution fixes apply to Windows Message Queuing, and eight critical elevation-of-privilege updates apply to Hyper-V. Microsoft also patched critical vulnerabilities involving Windows Schannel, TCP/IP, the Print Spooler and network device discovery services.

SecurityWeek says updates cover Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge and the Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the critical-severity update list. The latest round brought Microsoft’s yearly total of fixed vulnerabilities to more than 5,000. SecurityWeek says Windows 11 version 23H2 Enterprise and Education editions receive their final monthly security updates in November 2026, with no further updates planned for devices running them.

BleepingComputer says Microsoft released the Windows 10 KB5131096 extended security update including the November 2026 Patch Tuesday fixes. The update moves Windows 10 to build 19045.7846 and Windows 10 Enterprise LTSC 2021 to build 19044.7846.

October 2026 set the previous high mark. TechSpot says October 2026 Patch Tuesday fixed 1,413 security bugs, marking the first time a single month topped 1,000 bugs and exceeding any previous year’s total. October fixes included 1,102 vulnerabilities in Windows, 134 in Office, 36 in SharePoint Server, 22 in SQL Server and 61 in developer tools.

TechSpot says the upward trend began after Microsoft started using large language models to scan software for security flaws. Microsoft introduced a new model called risk cohorts for grouping related vulnerabilities, warning it is experimental and that grouping does not indicate overall severity or risk. SecurityWeek says Adobe’s most recent Patch Tuesday updates address approximately 110 vulnerabilities in nine products.

Redmondmag says Satnam Narang, senior staff research engineer at Tenable, said the Outlook zero-day attack starts with a malicious Office file and the attacker could steal the victim’s NTLMv2 hash for NTLM relay attacks or password cracking. Jack Bicer, director of vulnerability research at Action1, warned that some flaws could expose laptops and desktops on untrusted local networks such as hotel or airport Wi-Fi without valid credentials. Jake Knott, head of threat intelligence at watchTowr, said administrators face a steady stream of critical vulnerabilities and competing priorities, making it difficult to decide what actually matters.