November 2026 Patch Tuesday: 1,094 Flaws, One Exploited

Microsoft’s November 2026 Patch Tuesday, released on November 10, 2026, fixes 1,094 vulnerabilities across Windows, Office, SQL Server, Exchange Server, SharePoint, Azure services, and developer tools. The total falls below October’s Patch Tuesday (1,413 flaws) but still makes this the second-largest monthly release on record.

The release includes one zero-day and over 60 critical-rated vulnerabilities. The zero-day is an exploited Microsoft Outlook spoofing flaw that leaks NTLMv2 hashes, and no other flaw was publicly disclosed before the fix.

Elevation of Privilege (EoP) vulnerabilities make up 49% of the release. Remote Code Execution (RCE) follows at 27%, and Information Disclosure accounts for another 14%. Denial of Service, Security Feature Bypass, Spoofing, and Tampering share the remaining 10%.

Key Takeaways

• Microsoft’s November 2026 Patch Tuesday fixes 1,094 vulnerabilities, the second-largest monthly release on record, with 63 rated Critical
• CVE-2026-124194, an exploited Outlook spoofing flaw that leaks NTLMv2 hashes, is fixed through Office updates rather than the Windows cumulative update, so Office channels should move first
• CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities (KEV) catalog on November 10, with a November 24 remediation deadline for federal agencies
• The highest-scoring Critical fixes that require patching, all rated 9.8, are unauthenticated RCEs in Windows LDAP, Windows Search, and the Xbox Live Networking Service
• CVE-2026-116928, a Windows Search flaw reachable through Exchange Server without user interaction, means Exchange servers need the Windows update as well as the Exchange fixes

Zero-Day Vulnerability in November 2026 Patch Tuesday

This month, only one flaw is listed as a zero-day: an Outlook spoofing vulnerability rated Moderate with a CVSS v3.1 score of 6.5. Microsoft lists CVE-2026-124194 as exploited. No vulnerabilities in the release were publicly disclosed ahead of the fix.

CVE-2026-124194 (CVSS 6.5): Microsoft Outlook Spoofing Vulnerability

CVE-2026-124194 stems from a missing warning for an unsafe action (Common Weakness Enumeration CWE-356) in Microsoft Outlook. Microsoft’s security advisory explains that when a target opens a crafted message file, Outlook connects to an attacker-controlled network location without showing the external-content warning that should flag the request. That connection discloses the user’s NTLMv2 hash, the credential material Windows uses for NT LAN Manager (NTLM) authentication.

An unauthenticated attacker can send the file, but the target must open it; Microsoft states that the Preview Pane is not an attack vector. The spoofing label and moderate score understate the risk. A captured hash can be relayed to internal services that accept NTLM without signing or Extended Protection for Authentication (EPA), or cracked offline when the password behind it is weak.

Microsoft has not named the attackers, their targets, or the scale of the activity, and no indicators of compromise have been published. Microsoft credits the discovery to a security researcher who worked with Anthropic’s Claude large language model.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10, 2026, setting a remediation deadline of November 24, 2026 for covered federal agencies.

The fix ships through Office security updates, including those for Microsoft 365 Apps for Enterprise and Office LTSC 2024, not in the Windows cumulative update KB5132061. Organizations that patch only Windows leave Outlook exposed.

Critical Vulnerabilities in November 2026 Patch Tuesday

Microsoft rated 63 of this month’s vulnerabilities critical. The highest-scoring entries are:

• CVE-2026-119990 (CVSS 9.8): Azure OpenAI Elevation of Privilege Vulnerability (no customer action required)
• CVE-2026-114160 (CVSS 9.8): Azure Managed Grafana Elevation of Privilege Vulnerability
• CVE-2026-119958 (CVSS 9.8): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
• CVE-2026-116928 (CVSS 9.8): Windows Search Remote Code Execution Vulnerability
• CVE-2026-112967 (CVSS 9.8): Windows Xbox Live Networking Service Remote Code Execution Vulnerability
• CVE-2026-118207 (CVSS 8.8): Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2026-118146 (CVSS 8.8): Windows Active Directory Domain Services Remote Code Execution Vulnerability
• CVE-2026-110043, CVE-2026-110068, CVE-2026-111309 (CVSS 8.8): Microsoft Office Outlook Remote Code Execution Vulnerability
• CVE-2026-119952 (CVSS 8.1): Windows Schannel Remote Code Execution Vulnerability
• CVE-2026-116710, CVE-2026-119963, CVE-2026-119964 (CVSS 8.1): Windows Message Queuing Remote Code Execution Vulnerability
• CVE-2026-109459, CVE-2026-119967 (CVSS 8.1): Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
• CVE-2026-113862 (CVSS 8.1): Windows Network Address Translation (NAT) Remote Code Execution Vulnerability

Windows Search Turns Exchange Into a Zero-Click Target

CVE-2026-116928 stands out among the fixes that require customer action. The flaw sits in Windows Search but can be reached through Exchange Server, where an unauthenticated attacker can trigger code execution without the recipient opening anything. ZDI’s analysis rates it more severe than any of the nine Exchange Server fixes released this month.

Because the fix ships in Windows, Exchange servers need the November Windows cumulative update as well as the Exchange security update for CVE-2026-118207, an authenticated RCE rated 8.8. Only Exchange Server Subscription Edition (SE) still receives security updates, so older Exchange versions remain exposed to both.

Unauthenticated RCEs Reach Identity and Network Services

The LDAP flaw, CVE-2026-119958, is an out-of-bounds write that an unauthenticated attacker can trigger over the network with no user interaction. LDAP runs on every domain controller, which puts directory infrastructure directly in scope. Schannel flaw CVE-2026-119952 is also unauthenticated and network-reachable; its high attack complexity keeps its score at 8.1, but Microsoft still rates it Exploitation More Likely.

The five Message Queuing flaws follow the same pattern, as do Critical RCEs in Credential Security Support Provider (CredSSP), Internet Information Services (IIS), and Windows Deployment Services (WDS), each rated 8.1. Xbox Live Networking Service flaw CVE-2026-112967 is a heap overflow reachable without authentication or user interaction.

Several flaws outside the Critical list also score 9.8 and need the same urgency. They include CVE-2026-85844, a Windows Kerberos authentication bypass that allows privilege escalation over the network, along with unauthenticated RCEs in Windows DNS (CVE-2026-88218), DHCP Server (CVE-2026-88243), SQL Server (CVE-2026-116945), and Windows Media Foundation (CVE-2026-96157). The same analysis counts about 30 potentially wormable vulnerabilities this month, while noting that some advisories are too thin to be certain.

Two Azure Flaws Join the 9.8 Group

Two Azure services also appear among the 9.8-rated Critical flaws. Microsoft revised its advisory for CVE-2026-119990 in Azure OpenAI to state that no customer action is needed, after first marking the flaw as requiring action without listing any steps. Teams that use Azure Managed Grafana should review the advisory for CVE-2026-114160 to confirm whether any action applies to their deployments.

How SOCRadar Can Help

With more than 1,000 fixes in a single cycle, the useful question is which ones touch the systems an organization actually runs and exposes. Within SOCRadar XTI, Vulnerability Intelligence enriches each Microsoft CVE with exploitation status, KEV changes, and threat actor activity, so teams see quickly when a flaw such as the LDAP or Windows Search RCE moves from “Exploitation More Likely” to active use. Exposure Management flags internet-facing assets, such as Exchange and IIS servers, that still run vulnerable versions after rollout. Together, they help teams order patching by real exposure and confirm from the outside that critical fixes took effect. Confirming whether an NTLM hash was already captured or relayed still requires internal authentication and network logs.

Apply Microsoft’s Security Updates for November 2026

With 1,094 fixes in one cycle, roll out in phases, ordered by exploitation and exposure. Prioritize:

• Office and Outlook clients for CVE-2026-124194: Deploy the Microsoft 365 Apps and Office LTSC 2024 security updates fleet-wide first and confirm the new Outlook build on endpoints; the same updates close three Critical Outlook RCEs rated 8.8
• NTLM exposure during rollout: Block outbound Server Message Block (SMB) traffic on TCP port 445 to the internet, enforce SMB and LDAP signing, enable EPA, and add privileged accounts to the Protected Users group; these are general hardening steps, not a vendor workaround
• Exchange Server: Install the Windows cumulative update for CVE-2026-116928 and the Exchange security update for CVE-2026-118207 in the same maintenance window
• Domain controllers and authentication servers: Patch the LDAP, Kerberos, Active Directory Domain Services (AD DS), Schannel, and CredSSP flaws together, since they share the same identity tier
• Network-facing Windows services: Patch DNS, DHCP, Message Queuing, IIS, WDS, and NAT hosts, along with SQL Server instances, disable Message Queuing where it is unused, and restrict TCP port 1801 to trusted segments where it must run
• Hyper-V hosts: Apply the eight Critical Hyper-V elevation of privilege fixes on virtualization and virtual desktop infrastructure (VDI) hosts
• SharePoint Server: Patch CVE-2026-120002, an authenticated EoP that scores 9.9 even though Microsoft rates it Important
• Coverage verification: Confirm installation with at least two signals, such as endpoint management reporting and vulnerability scans, since failed installs, deferred reboots, and offline devices leave gaps
• End-of-support systems: Migrate devices off Windows 11 version 23H2 Enterprise and Education, which received their final security update (KB5131087) this month, and move workloads off .NET 8, .NET 9, and PowerShell 7.4, which have also reached end of support

See Microsoft’s November 2026 release notes for reference.

SAP Patches Four CVSS 10.0 Flaws on the Same Day

Microsoft wasn’t the only major vendor shipping urgent fixes on November 10. SAP’s November 2026 Security Patch Day adds 35 new security notes, nine of them rated HotNews. Four flaws carry the maximum CVSS score of 10.0, and none of them requires authentication:

• CVE-2026-76964 and CVE-2026-89126 (ICM2SHELL): Memory corruption in how the Internet Communication Manager (ICM) of SAP NetWeaver AS ABAP and SAP Web Dispatcher handle WebSocket control frames
• CVE-2026-89103 (PROXYGATE): Broken access control in the default access control list (ACL) of SAP Gateway
• CVE-2026-120017: A SAML2 authentication bypass in SAP NetWeaver AS ABAP and ABAP Platform, caused by assertion signatures that go unverified

The researchers behind ICM2SHELL and PROXYGATE shared working exploits with SAP but have not seen either flaw used in attacks. Three more notes score 9.9 and need only a low-privileged account, including code injection in NetWeaver KM XML Forms and OS command injection through SAPFTP over RFC. There is no official workaround for the Gateway and SAML2 flaws. Disabling WebSocket support blocks ICM2SHELL but breaks the features that rely on it, so the practical fix is to apply the kernel, Web Dispatcher and SAP_BASIS updates.

Frequently Asked Questions

What Is an NTLM Relay Attack?

An NTLM relay attack forwards a victim’s NTLM authentication attempt to another server in real time, letting the attacker sign in as the victim without knowing the password. It succeeds against services that accept NTLM without SMB signing, LDAP signing, or EPA. Flaws such as CVE-2026-124194, which make a client authenticate to an attacker-controlled server, supply the authentication attempt these attacks need.

What Makes a Vulnerability Wormable?

A wormable vulnerability can be exploited remotely without authentication or user interaction, which allows self-propagating malware to spread from one vulnerable system to the next. Analysts flag a flaw as potentially wormable when its CVSS vector shows network access with no privileges and no user interaction (AV:N/PR:N/UI:N). In November 2026, that group includes the five Message Queuing flaws and the LDAP, Schannel, CredSSP, and IIS RCEs.

What Does “No Customer Action Required” Mean in a Microsoft Advisory?

Microsoft uses the label for cloud service flaws it fixes on its own infrastructure, so customers have nothing to install. CVE-2026-119990 in Azure OpenAI is this month’s example. Organizations can still review tenant audit logs for unexpected activity in the affected service.

How Can Teams Confirm Outlook Has the November 2026 Fix?

In Outlook, File, then Office Account, then About Outlook shows the installed version and build, which can be compared with the fixed builds listed in Microsoft’s advisory for CVE-2026-124194. At scale, the Microsoft 365 Apps admin center or endpoint management reporting shows the update channel and build each device runs.