November 2026 Patch Tuesday: 1,094 CVEs, 1 exploited zero-day

Microsoft's November 2026 Patch Tuesday release addresses 1,094 Microsoft CVEs. That's down from October's record of 1,413, but it's still the second-largest Patch Tuesday release to date, ahead of September's 974. The release spans Windows, Microsoft 365 and Office apps, SQL Server, SharePoint Server, Exchange Server, Azure, Defender, and developer tools. Microsoft is also republishing 165 non-Microsoft CVEs.

One vulnerability is already under active exploitation: CVE-2026-124194, a spoofing flaw in Microsoft Outlook. Microsoft rates it Moderate, and no CVEs in this release were publicly disclosed before the patch. For the third month in a row, the vulnerability attackers are actually using is rated below Critical, which is why exploit status should set the order of work.

With more than 1,000 Microsoft CVEs to evaluate, IT teams need a risk-based rollout that starts with the vulnerabilities attackers are using and the systems where a compromise would do the most damage. This post covers where the vulnerabilities are concentrated, how the Outlook zero-day works and where its fix ships, which Critical vulnerabilities to address next, and how to sequence the rollout.

Microsoft patch breakdown for November 2026

Of the 1,093 CVEs with severity ratings, Microsoft rated 63 Critical, 1,029 Important, and 1 Moderate.

Elevation of privilege and remote code execution account for about 76% of the release:

Remote code execution flaws can give an attacker initial access, and elevation of privilege flaws can turn that limited access into full control of a system. With more than 800 of these two types in one release, IT teams need to know which affected systems are exposed and which hold privileged access.

Where the vulnerabilities are concentrated

Windows accounts for about two-thirds of this month's CVEs. Office and SharePoint Server add another 201, which keeps document-based risk high on the list.

Microsoft's published figures for this release differ slightly: the release notes and product family breakdown state 1,094 CVEs, while severity ratings cover 1,093. This post uses 1,094, the figure in Microsoft's release notes.

One exploited zero-day in Outlook

Microsoft has flagged one CVE as exploited this month. It's the only Moderate-rated vulnerability in the entire release.

An unauthenticated attacker sends a specially crafted message file and gets the recipient to open it in Outlook. Opening the file makes Outlook connect to an attacker-controlled network location without showing the usual external-content warning. That connection can expose the user's NTLMv2 hash, which an attacker can use to impersonate the user in follow-on attacks.

The user has to open the file, and the Preview Pane is not an attack vector. Microsoft hasn't shared who is behind the attacks or how widespread they are. Moderate is one step above Microsoft's lowest rating, yet this is the one CVE in the release attackers are confirmed to be using, so patch it first on every device running Outlook.

The fix ships in the Microsoft 365 Apps and Office LTSC 2021 and 2024 security updates. It is not part of the Windows cumulative update (KB5132061), so organizations that deploy only Windows updates remain exposed until the Office update is installed.

CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10, 2026, with a remediation due date of November 24, 2026 for federal agencies.

Critical vulnerabilities to prioritize next

Microsoft rated 63 vulnerabilities Critical this month: 48 remote code execution and 15 elevation of privilege. Rather than treating them as one group, prioritize them by the affected infrastructure, how exposed it is, and what a compromise would put at risk.

Identity, directory, and authentication services

Domain controllers and the protocols that secure authentication give an attacker reach across the whole environment. The Active Directory Domain Services flaw (CVSS 8.8) requires an authenticated attacker, while the Schannel flaw (CVSS 8.1) can be exploited by an unauthenticated attacker over the network. Microsoft assessed both as Exploitation More Likely.

Exchange, IIS, and deployment servers

Exchange Server (CVE-2026-118207), Internet Information Services (CVE-2026-119961), and Windows Deployment Services (CVE-2026-119951) each have a Critical remote code execution vulnerability. The Exchange flaw scores CVSS 8.8 and is assessed as Exploitation More Likely.

These servers often face the internet or touch every endpoint that relies on them for mail, web services, or provisioning. SharePoint Server also deserves attention: CVE-2026-120002 is rated Important but scores CVSS 9.9, another case where the severity label understates the risk.

Network-facing Windows services

All of these are remote code execution vulnerabilities in services that listen on the network. Identify where Message Queuing and the other affected services are enabled, and move externally reachable systems to the front of the queue. The NAT flaw (CVSS 8.1) is assessed as Exploitation More Likely.

Hyper-V and Windows privilege escalation

Windows Hyper-V has eight Critical elevation of privilege vulnerabilities this month:

• CVE-2026-113753

• CVE-2026-113856

• CVE-2026-113860

• CVE-2026-113861

• CVE-2026-113864

• CVE-2026-113865

• CVE-2026-119947

• CVE-2026-119960

The Graphics Kernel (CVE-2026-119966 and CVE-2026-125137) and Remote Desktop Services (CVE-2026-119957) also have Critical elevation of privilege flaws. Paired with an initial-access vulnerability, these can give an attacker SYSTEM-level control.

Hyper-V hosts often run many production workloads, so a host-level flaw puts every guest on it at risk. Use staged testing and coordinated maintenance windows where an immediate rollout could disrupt services, but keep those windows short.

Microsoft 365 and Office applications

Office applications account for 22 of this month's Critical remote code execution vulnerabilities:

Excel again has the largest concentration of Critical flaws in a single app. Malicious documents remain one of the most common paths into user environments. The three Critical Outlook flaws (CVE-2026-110043, CVE-2026-110068, and CVE-2026-111309) are not marked as exploited. They ship through the same Office update channel as the zero-day fix, so one Office rollout can address both.

File, media, and search components

Critical remote code execution vulnerabilities also affect Graphic Fonts (CVE-2026-119969), the Windows Codecs Library (CVE-2026-113749), Raw Image Extension (CVE-2026-114169), Windows Search (CVE-2026-116928), and Print Spooler Components (CVE-2026-113752).

The font, codec, image, and search flaws can be triggered by crafted content, which puts them within reach on everyday endpoints. Print Spooler runs on most Windows devices and is easy to overlook in patch cycles, so confirm it's covered by the same rollout as the rest of the release.

Azure and security services

Azure OpenAI (CVE-2026-119990) and Azure Managed Grafana (CVE-2026-114160) each have a Critical elevation of privilege vulnerability, and Microsoft Defender has a Critical remote code execution vulnerability (CVE-2026-122194). Cloud services and security tooling need the same verification as on-premises systems, and a flaw in a security product is a high-value target in its own right.

How to prioritize November 2026 patches

No fixed timeline fits every environment. Use these tiers as a starting point, then adjust for exposure, business impact, and testing requirements.

Patch within 72 hours

• CVE-2026-124194, through the Microsoft 365 Apps and Office LTSC updates, on every device running Outlook

• Active Directory Domain Services, LDAP, Schannel, and CredSSP on domain controllers and authentication servers

• Exchange Server and IIS, starting with internet-facing systems

• Message Queuing, SMB Server, TCP/IP, and NAT on systems where those services are reachable

• Hyper-V hosts

• Google Chrome CVE-2026-125350, covered in the third-party section below

• Any CVE later added to the CISA KEV catalog or flagged Exploitation More Likely

Patch within 1 to 2 weeks

• Remaining Office Critical vulnerabilities, starting with Excel, then Word, Outlook, and PowerPoint. Microsoft lists Office updates as cumulative except for Office 2016, so the zero-day rollout already carries most of these fixes on Microsoft 365 Apps and Office LTSC. Confirm Office 2016 separately.

• Graphic Fonts, Codecs Library, Raw Image Extension, Windows Search, and Print Spooler Components

• Graphics Kernel, Remote Desktop Services, and TPM elevation of privilege vulnerabilities

• SharePoint Server, including CVE-2026-120002

• Azure OpenAI, Azure Managed Grafana, and Microsoft Defender

• Visual Studio, Visual Studio Code, and .NET on developer workstations

• Adobe Connect and Adobe Experience Manager servers

Exposure should still override the default timeline. Users who routinely open external files may need Office updates sooner.

Regular patch cycle

• Important-rated elevation of privilege and information disclosure vulnerabilities in components with limited exposure

• Local-access-only and device driver issues on systems with restricted physical access

• Non-internet-facing systems with compensating controls in place

Notable third-party updates

Several other vendors shipped security fixes in the same week, including one more exploited zero-day.

Google Chrome zero-day

Google fixed CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome's XML component that is being exploited in the wild. The fix is in Chrome 157.0.8103.50/.51 for Windows and Mac and in Extended Stable 156.0.8078.96, and the same update addresses eight other vulnerabilities. CISA added CVE-2026-125350 to the KEV catalog on November 10, the same day as the Outlook flaw.

Chrome downloads updates in the background but applies them only after a relaunch, so confirm installed versions rather than download status. Other Chromium-based browsers share the same engine code, so watch for updates from those vendors too.

Adobe

Adobe released fixes for about 110 vulnerabilities across nine products: Adobe Experience Manager, Adobe Connect, Photoshop, Premiere, After Effects, Audition, Media Encoder, Dimension, and the Content Credentials SDK. Critical vulnerabilities were fixed in Adobe Connect and Adobe Experience Manager, including six Adobe Connect flaws with a CVSS score of 10. Adobe says it isn't aware of any exploitation.

Adobe ColdFusion 2021 also reaches the end of extended support on November 10, 2026, according to Adobe's support timeline. Its last update shipped in December 2025, so any remaining ColdFusion 2021 servers need an upgrade plan.

Republished non-Microsoft CVEs

Microsoft is republishing 165 non-Microsoft CVEs this month, up from one in October. Combined with the Chrome and Adobe releases, that's a reminder to keep browsers, creative tools, and server applications in the same vulnerability-management workflow as Windows and Office. Separate processes can leave gaps even when OS patching is current.

Why November Patch Tuesday matters for IT teams

November's release raises three operational issues that go beyond any individual CVE.

1. Fixes arrive through more than one update channel

This month's only exploited Microsoft vulnerability is fixed in the Office update, the Chrome zero-day needs a browser relaunch, and Adobe ships on its own schedule. A process built around Windows Update alone can report a device as current while it's still exposed.

Teams need patch status for each application as well as each OS build, along with a clear view of which devices are still missing the updates that matter most this month.

2. Windows 11 23H2 Enterprise and Education reach end of updates

Microsoft says November's update (KB5131087) is the last security update for Windows 11 version 23H2 Enterprise and Education. Windows 11 version 24H2 Home and Pro already reached end of updates in October, and commercial Windows 10 22H2 devices need an Extended Security Updates Year 2 license to receive this month's fixes.

Devices on these editions stop receiving fixes after their end date, no matter how quickly a team patches. Identify them now and plan upgrades. Microsoft has also said there will be no December 2026 non-security preview update, though the December security update is still expected on Patch Tuesday.

3. Security hardening changes may need testing

With this update, Windows 11 clients offer NTLM message signing by default for non-anonymous connections, which helps reduce NTLM relay attacks. It's a timely change in a month when the exploited zero-day targets NTLMv2 hashes.

PowerShell now applies stricter encoding checks to signed scripts, so scripts with invalid UTF-8 encoding may fail signature validation even if they worked before. Microsoft's guidance is to save those scripts as UTF-8 with a byte order mark and sign them again. Test signed automation scripts on a small group of devices before a broad rollout.

How Splashtop AEM can help prioritize and deploy patches

A 1,094-CVE release with an exploited zero-day gives IT teams two jobs: finding what matters in their environment and deploying the right updates quickly. Splashtop AEM (Autonomous Endpoint Management) handles both from a centralized console.

• Find exposed devices: Splashtop AEM continuously scans Windows and macOS endpoints for CVEs, including vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, alongside patch status and hardware and software inventory. Teams can see which endpoints are still exposed as updates roll out.

• Prioritize what attackers are using: AI-powered CVE summaries and risk signals, including EPSS scores and KEV status, help teams move exploited vulnerabilities ahead of the rest of a 1,000-plus CVE release.

• Deploy and verify faster: Real-time OS and third-party application patching, automated policies, maintenance windows, restart controls, and update rings let teams test server or Hyper-V updates on a smaller group of devices first. Teams can then expand the rollout and track which installs succeeded, failed, or were delayed.

• Strengthen existing workflows: Splashtop AEM can enhance Microsoft Intune by adding real-time patching, CVE visibility, and remediation. Teams using an RMM can use it to fill gaps in patch visibility and automation.

Find and fix exposed endpoints faster with Splashtop AEM

November's release is smaller than October's, yet it's still the second-largest Patch Tuesday to date, and its one exploited Microsoft vulnerability is fixed outside the Windows update. IT teams need to see which endpoints are exposed across every update channel, deploy the most urgent fixes first, and confirm each install.

Start a free trial of Splashtop AEM to see which endpoints are vulnerable, prioritize high-risk updates, and deploy patches faster.