Microsoft’s November Patch Tuesday follows record October CVE cycle

Microsoft’s November Patch Tuesday follows an October 2026 update cycle that fixed 1,407 unique CVEs and ran about two and a half hours late. Help Net Security characterized the October total as record-breaking in a Nov. 6, 2026 forecast.

Vicarius and Tenable counted 1,407 October CVEs, with 69 rated critical, 1,337 important and one low. Help Net Security counted 78 critical vulnerabilities in the same cycle. Computerworld reported 1,408 CVEs, differing from the other counts.

Computerworld put September 2026 Patch Tuesday at 963 CVEs, while Vicarius reported 964 as the previous record. The September cycle had two exploited flaws. CVE-2026-81963 affected the Windows Update Stack, and CVE-2026-85880 affected Advanced Local Procedure Call. October’s update spanned 301 product families and components.

The actively exploited zero-day CVE-2026-96951 was part of October’s cycle. The flaw is a Windows Shell security feature bypass. It affects Windows 10, Windows 11 and Windows Server.

CISA added CVE-2026-96951 to its exploited vulnerabilities catalog on Oct. 13, 2026. Federal remediation was due by Oct. 16, 2026. Tenable said October’s release patched two zero days, with one exploited in the wild.

Help Net Security said few October flaws called for immediate emergency action. Elevation of privilege flaws made up 47.9 percent of October CVEs, totaling 674. Remote code execution flaws accounted for 22.3 percent of October CVEs, totaling 314, while information disclosure covered 17.8 percent, totaling 251.

Remote code execution flaws made up 56 of the 69 critical October CVEs. Microsoft assigned the Exploitation More Likely rating to 109 October CVEs. 54 scored 9.8 or higher on CVSSv3.

CVE-2026-70571 affects Exchange Server as a critical remote code execution flaw scored 8.1. Microsoft rated it Exploitation More Likely. An attacker exploits CVE-2026-70571 by sending a crafted e-mail that prompts an Exchange server to process it through internal content conversion.

CVE-2026-70229 is a critical flaw in Active Directory Domain Services allowing remote code execution. Microsoft scored it 8.1 and rated Exploitation More Likely. An unauthenticated attacker can exploit CVE-2026-70229 with a specially crafted packet aimed at the Active Directory Domain Services service.

CVE-2026-96934 is a critical flaw in Windows DHCP Server allowing remote code execution. It carries a score of 9.8. Attackers can exploit it with no authentication or user interaction. CVE-2026-83869 is a Windows DNS Server remote code execution flaw scored 9.8, and DNS Server was the second most-patched component with 52 CVEs.

CVE-2026-100219 and CVE-2026-105016 are critical flaws in Microsoft QUIC allowing remote code execution. Both scored 9.8 and carry an Exploitation Less Likely rating. CVE-2026-100202 is a critical use-after-free flaw scored 9.8 in the Windows Message Queuing Queue Manager. A specially crafted message triggers it.

CVE-2026-70242 is a critical flaw in Outlook allowing remote code execution. It carries a score of 9.8. Viewing a crafted e-mail in the Reading Pane triggers it without user interaction. Microsoft addressed five critical Outlook remote code execution flaws this month; all list the Reading or Preview Pane as an attack vector.

CVE-2026-108398 is a publicly disclosed.NET Framework feature bypass. It carries a score of 8.8 and bypasses Windows Defender Application Control. Microsoft assigned CVE-2026-108398 an Exploitation Less Likely rating.

DNS Benchmark Pro reported that Tenable counted 1,407 October CVEs, CrowdStrike counted 1,413 and Talos counted 1,415. Help Net Security identifies CVE-2026-10839 as a publicly disclosed.NET Framework bypass. Vicarius and Tenable identify CVE-2026-108398 instead.

The Zero Day Initiative counted 55 wormable CVEs in October’s release. They cluster in DHCP Server, Network Policy Server and Remote Desktop Gateway. Dustin Childs of the initiative described the danger as “an unprecedented risk of autonomous, network-wide propagation.”

Extended support ended on Oct. 13, 2026 for Windows Server 2012 and 2012 R2. 2012-era hosts no longer receive patches for October’s wormable vulnerabilities.

Microsoft shipped an out-of-band fix for CVE-2026-111497 on Oct. 25. The company also knows it as Broccoli2Shell, Node2Shell or HTTP2Shell. The fix covers Brotli libraries across.NET 8, 9, 10 and.NET 11 Release Candidate 3. Researchers have published proof-of-concept code, but no wild exploitation is known.

Windows Server 2022 entered extended support on Oct. 13, 2026. Monthly security updates will continue through Oct. 14, 2031. Support also ended on Oct. 13, 2026 for Windows 10 Enterprise 2016 LTSB and Windows 10 IoT Enterprise LTSB 2016. November Patch Tuesday is the second-to-last Patch Tuesday of 2026.

Help Net Security forecasts that Microsoft will continue issuing broad product updates with high CVE counts. Help Net Security expects updates from Adobe for Acrobat, Reader, InCopy, InDesign and Premiere.

October preview patches resolved Always On VPN connection failures that September Patch Tuesday introduced. A Smart App Control toggle on Windows 11 24H2 and later devices appeared grayed out; October preview patches fixed that issue. The November Patch Tuesday cumulative release will include all October preview patch fixes.