Microsoft fixed 1,091 CVEs on November 10, 2026, the second-largest Patch Tuesday on record after October's 1,407. One of them, an Outlook spoofing flaw that leaks a user's NTLMv2 hash, was already being exploited in the wild as a zero-day.
Key takeaways
• 1,091 CVEs: 61 critical, 1,029 important and 1 moderate. That is 316 fewer than October, but still the second-largest release we have tracked, and it takes 2026 past 5,000 Patch Tuesday CVEs.
• One exploited zero-day: CVE-2026-124194 in Outlook makes the client connect to an attacker-controlled location without its usual warning, exposing the user's NTLMv2 hash. CISA added it to the KEV catalog on release day.
• Mail and identity carry the biggest risk. A zero-click Windows Search flaw reachable through Exchange (CVE-2026-116928), an Exchange Server RCE rated "Exploitation More Likely" (CVE-2026-118207), and critical flaws in Active Directory, LDAP and Kerberos all land on servers attackers prize most.
• Sixteen CVEs score 9.8 or higher, including network-exploitable bugs in Windows DNS, DHCP Server, LDAP and Kerberos that need no authentication or user interaction.
Of the 1,091 CVEs, 61 are rated critical (5.6%), 1,029 important and 1 moderate. Microsoft rates 42 of them "Exploitation More Likely" and one "Exploitation Detected". Two further cloud-service CVEs that Microsoft has already fixed need no customer action and are not counted in the total; they are listed in the companion spreadsheet.
Volume in context
November's 1,091 CVEs rank second only to October 2026 (1,407) and ahead of September (964). Before summer 2026 no Patch Tuesday had exceeded about 200 CVEs; four of the last five releases have now passed 500. Across the eleven releases so far this year, Microsoft has fixed 5,157 CVEs, with 3,863 of them in the last four months alone.
What was patched
Elevation of privilege flaws make up nearly half of this month's release (48.8%), followed by remote code execution at 27.2%. Remote code execution dominates the critical tier: 48 of the 61 critical CVEs (78.7%) are RCEs.
This month's update includes patches for 285 product families and components. These 15 had the most CVEs; the companion spreadsheet lists every CVE with its product.
Zero-day exploited in the wild
Moderate
CVE-2026-124194 | Microsoft Outlook spoofing vulnerability
CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook with a CVSSv3 score of 6.5, rated moderate. The root cause is a user interface that does not warn the user of unsafe actions (CWE-356). According to Microsoft, an unauthenticated attacker sends a specially crafted message file and convinces the user to open it. Outlook then connects to an attacker-controlled network location without showing its usual external-content warning, disclosing the user's NTLMv2 hash, which the attacker can use to authenticate as that user. The Preview Pane is not an attack vector. According to Microsoft, it was exploited in the wild as a zero-day.
Since 2022, Microsoft has patched 10 other Outlook spoofing vulnerabilities, most recently CVE-2026-62882 in August 2026; CVE-2026-124194 is the first of them to be exploited in the wild. The moderate rating understates the practical risk: a captured NTLMv2 hash can be cracked offline or relayed to other services, which turns a single opened file into a foothold for lateral movement. CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10, 2026, with a federal remediation due date of November 24, 2026.
Other notable vulnerabilities
Critical
CVE-2026-116928 | Windows Search remote code execution vulnerability
CVE-2026-116928 is an out-of-bounds write (CWE-787) in the Windows Search component with a CVSSv3 score of 9.8, meaning it is network-exploitable with no authentication or user interaction. According to Microsoft, the attack path runs through Microsoft Exchange Server: an unauthenticated attacker sends an email with a specially crafted attachment, Exchange automatically processes the attachment for indexing, and the recipient never needs to open the email or the attachment. Successful exploitation runs code with the permissions of the processing service. Microsoft rates it "Exploitation Less Likely", but a zero-click path into the mail server makes it a top priority for on-premises Exchange.
Critical
CVE-2026-118207 | Microsoft Exchange Server remote code execution vulnerability
CVE-2026-118207 is a critical remote code execution flaw in Exchange Server with a CVSSv3 score of 8.8, which the CVE record describes as improper input validation. According to Microsoft, an authenticated attacker with low-level access can send a specially crafted request to run code on the server, with no user interaction required. Microsoft rates it "Exploitation More Likely". Any valid mailbox account, including one obtained through phishing or the NTLM hash theft described above, is enough to reach it. It is one of nine Exchange Server CVEs fixed this month.
Critical
CVE-2026-118146 | Windows Active Directory Domain Services remote code execution vulnerability
CVE-2026-118146 is an incorrect-authorization flaw (CWE-863) in Active Directory Domain Services with a CVSSv3 score of 8.8. According to Microsoft, an authenticated attacker with low-level access to an affected server can send a specially crafted request to execute code on it, with no user interaction. Microsoft rates it "Exploitation More Likely". A companion flaw, CVE-2026-118148, is a critical Active Directory Domain Services elevation of privilege vulnerability (CVSSv3 7.5, also "Exploitation More Likely") that gives an attacker who wins a race condition SYSTEM privileges. On domain controllers, either one can turn an ordinary domain account into control of the directory.
Important
CVE-2026-85844 | Windows Kerberos elevation of privilege vulnerability
CVE-2026-85844 is an authentication bypass using an alternate path or channel (CWE-288) in Windows Kerberos with a CVSSv3 score of 9.8. According to Microsoft, an unauthenticated attacker can send specially crafted Kerberos authentication traffic and relay the resulting authentication to a domain controller, gaining SYSTEM privileges on it. No user interaction is required. Microsoft rates it important and "Exploitation Less Likely", but SYSTEM on a domain controller is full domain compromise, so we place it alongside the critical identity fixes.
Critical
CVE-2026-119958 | Windows LDAP remote code execution vulnerability
CVE-2026-119958 is an out-of-bounds write (CWE-787) in Windows LDAP with a CVSSv3 score of 9.8. According to Microsoft, an unauthenticated attacker can use a specially crafted set of LDAP calls to execute arbitrary code in the context of the LDAP service. Microsoft rates it "Exploitation Less Likely". Because domain controllers expose LDAP to every machine on the network, it belongs in the first patch wave with the other directory fixes.
Critical
CVE-2026-119952 | Windows Schannel remote code execution vulnerability
CVE-2026-119952 is a remote code execution flaw in Schannel, the Windows TLS/SSL implementation, with a CVSSv3 score of 8.1 and a root cause of observable timing discrepancy (CWE-208). According to Microsoft, an unauthenticated attacker can send a specially crafted packet to an affected service over the network, with no authentication or user interaction, although specific protocol settings or configurations must be in place. Microsoft rates it "Exploitation More Likely". A second critical "More Likely" network bug, CVE-2026-113862 in Windows Network Address Translation (CVSSv3 8.1), can also be triggered by an unauthenticated packet if the attacker wins a race condition.
Important
CVE-2026-120002 | Microsoft SharePoint Server elevation of privilege vulnerability
CVE-2026-120002 is an incorrect-authorization flaw (CWE-863) in SharePoint Server with a CVSSv3 score of 9.9, the highest score this month. According to Microsoft, an authenticated attacker with site read access and membership in the relevant SharePoint Secure Store target application can send a crafted request that makes SharePoint perform unauthorized actions on a connected business service using shared credentials. Microsoft rates it "Exploitation Less Likely". The impact reaches beyond SharePoint itself into whatever back-end systems those stored credentials unlock.
Important
CVE-2026-88218 | Windows DNS remote code execution vulnerability
CVE-2026-88218 is a double free (CWE-415) in Windows DNS with a CVSSv3 score of 9.8, network-exploitable with no authentication or user interaction. According to Microsoft, an in-network attacker could gain remote code execution by calling arbitrary endpoints. Microsoft rates it "Exploitation Less Likely". It heads a group of ten Windows DNS remote code execution fixes this month; Windows DNS components account for 33 CVEs in total.
Other Windows DNS RCEs patched this month (9)
Microsoft also fixed three critical Outlook remote code execution flaws where the Preview Pane is an attack vector: an attacker sends a crafted email, and simply previewing it can run code with the user's permissions.
Critical Outlook RCEs with the Preview Pane as an attack vector (3)
Five critical Windows Message Queuing (MSMQ) remote code execution flaws were also patched. They only matter on systems where the Message Queuing service is enabled.
Critical Windows Message Queuing RCEs patched this month (5)
Patch-first list
With more than a thousand CVEs in one release, order matters more than ever. We ranked these by known exploitation first, then by exposure and impact on mail, identity and network infrastructure, rather than by CVSS score alone. The complete list of all 1,091 CVEs, with severity, CVSS, exploitability and root cause, is in the companion spreadsheet.
How Vicarius helps
A release of this size is where prioritization stops being a nice-to-have. vRx maps every November CVE to the assets in your environment, so you can see which of the 1,091 actually apply to you and start with the exploited Outlook zero-day and the Exchange, Active Directory and DNS servers that attackers target first.
From there, vRx patch management deploys Microsoft's updates and third-party fixes from the Apps & OS patch catalog on your own schedule. For systems you cannot reboot or patch right away, such as a domain controller or Exchange server mid-change window, patchless protection helps reduce exposure until the update is in place.
Frequently asked questions
How many vulnerabilities did Microsoft fix in November 2026 Patch Tuesday?
Microsoft fixed 1,091 CVEs that require customer action: 61 critical, 1,029 important and 1 moderate. It is the second-largest Patch Tuesday on record, behind October 2026 (1,407).
Were any November 2026 Patch Tuesday vulnerabilities exploited in the wild?
Yes. CVE-2026-124194, a Microsoft Outlook spoofing vulnerability that exposes a user's NTLMv2 hash, was exploited as a zero-day. CISA added it to the Known Exploited Vulnerabilities catalog on November 10, 2026.
What should I patch first?
Start with the Outlook zero-day (CVE-2026-124194), then Exchange servers (CVE-2026-116928, CVE-2026-118207) and domain controllers (CVE-2026-118146, CVE-2026-118148, CVE-2026-85844, CVE-2026-119958), followed by DNS and DHCP servers. The patch-first list above gives the full order.
Related reading
• Microsoft's October 2026 Patch Tuesday addresses a record 1,407 CVEs
• Only 1.48% of CVEs were confirmed exploited. What should vulnerability teams do?
• Patch verification checklist: how to prove a vulnerability is fixed
Sources
• Microsoft November 2026 Security Updates release notes
.webp)
%20Signals%20a%20New%20Era%20of%20Supply%20Chain%20Risk.webp)
