November 2026 Patch Tuesday: 1,094 CVEs, One Exploited Zero-Day
by Brad Hibbert, COO & CSO//
Microsoft's November 2026 Patch Tuesday landed on November 10 with 1,094 CVEs. That is down from October's record of 1,411, but it is still the second-largest release Microsoft has ever shipped, and the second month running to pass every full-year total from before 2026. Only one flaw is being exploited, an Outlook spoofing bug that quietly leaks a user's password hash. And by Tenable's reading of the advisory, the researcher who reported it used Claude to find it.
The Numbers: 1,094 CVEs, One Under Attack
Microsoft fixed 1,094 CVEs in the November release. Of the 1,093 that carry a severity rating, 63 are Critical, 1,029 are Important, and 1 is Moderate. The single Moderate flaw is the one being exploited. Microsoft also republished 165 non-Microsoft CVEs, and Google shipped a separate set of Edge and Chromium fixes on top.
The totals move around depending on how each tracker draws the line. BleepingComputer, Splashtop, and Microsoft's own release notes land on 1,094. Tenable counts 1,093 after setting aside items without a severity rating. Qualys reports 1,235 once Edge and other republished fixes are folded in. We use the 1,094 core figure, which keeps this month consistent with the earlier editions in the series.
By impact type:
| Vulnerability type | Count |
|---|---|
Elevation of privilege | 535 |
Remote code execution | 296 |
Information disclosure | 156 |
Denial of service | 46 |
Security feature bypass | 27 |
Spoofing | 22 |
Tampering | 11 |
Elevation of privilege and remote code execution together make up about 76 percent of the release. That mix matters for planning. Privilege escalation is how an attacker who is already on a machine moves up to full control, and remote code execution is how they get on the machine in the first place. Most of this month's volume feeds one of those two steps.
The work is also concentrated in a handful of product families.
| Product family | CVEs |
|---|---|
Windows | 726 |
Office | 174 |
SQL Server | 59 |
Developer Tools | 53 |
SharePoint Server | 27 |
Other | 25 |
Azure | 20 |
Exchange Server | 9 |
Defender | 1 |
Windows carries about two-thirds of the release on its own. Office holds 174, including 22 Critical remote code execution flaws spread across Excel, Word, Outlook, PowerPoint, and shared components. For most teams, Windows and Office are where the November effort will go.
Where November Sits in the 2026 Run
A count like 1,094 only means something next to the rest of the year. Patch Tuesday used to sit around 50 to 100 CVEs a month. In 2026 the floor moved, then moved again. July was the first month over 600. September crossed 900. October set the first four-digit record at 1,411. November is lower than October but still the second-largest release on record, and it is the second month in a row to top every full-year total Microsoft posted before 2026.
Microsoft core CVEs by month, 2026.
The volume is only half the picture. The count of zero-days shipped each month tells the other half.
Zero-days at release by month, 2026.
Lined up this way, the months tell a plain story. The volume is not a spike anymore. Three months in a row have landed near or above 1,000, so this is the operating range now, not an outlier to wait out. And the zero-day count has not moved with the volume. Microsoft is shipping ten times the CVEs it did a year ago, but the number under active attack at release is still one or two most months. More fixes are arriving, but attackers are not yet using most of them. That gap is where the planning time comes from, and it may not last.
The One Exploited Zero-Day: CVE-2026-124194 in Outlook
Only one flaw in this release is being exploited, and none were public before the fix shipped. It is CVE-2026-124194, a spoofing bug in Microsoft Outlook. Microsoft rates it Moderate, with a CVSS score of 6.5. It is the only Moderate CVE in the whole release, a case where the severity label and the real risk do not line up.
An attacker sends a crafted message file and gets the user to open it. When Outlook opens the file, it reaches out to a network location the attacker controls, and it skips the warning it would normally show before loading external content. That outbound connection can hand over the user's NTLMv2 hash, which an attacker can then crack offline or relay to authenticate as that user somewhere else. The user has to open the file for this to work, and the Preview Pane is not an attack path, but opening a message attachment is an everyday action, which is why this one is already being used.
Two operational details matter for the rollout:
- The fix ships through the Office update channels, specifically Microsoft 365 Apps and Office LTSC 2021 and 2024. It is not in the Windows cumulative update. If your patching keys on the Windows build number, this one will look done when it is not. Verify the Office build directly.
- CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10 and set a federal remediation deadline of November 24. Treat that date as the outside limit, not the target.
Fewer Zero-Days Does Not Mean Less Exploitation
One exploited zero-day in a 1,094-CVE month can look like a quiet release. Dustin Childs at the Zero Day Initiative pushed back on that directly. Fewer exploited zero-days does not mean less exploitation in the wild, he noted. His read is that attackers have changed method. AI has turned out to be very good at reverse-engineering a patch once it ships, and less good, for now, at finding and exploiting fresh bugs in closed-source software. So the pressure is shifting from zero-day discovery toward fast exploitation of flaws right after they are patched, which puts the weight on how quickly you deploy, not on whether a bug was public first.
By Tenable's reading of Microsoft's advisory, the exploited Outlook flaw was reported by a researcher who used Claude, Anthropic's large language model, to find it. The advisory does not name a Claude version. Set that next to the Project Glasswing work from earlier in the year, where AI models were run across large codebases to surface vulnerabilities at scale, and the direction is hard to miss. AI is now on both sides of the patch cycle. It is helping researchers and vendors find flaws, and it is helping attackers weaponize them faster once the fix is out.
For a security team, the lesson is about timing. The window between a patch shipping and its exploitation is getting shorter, and the volume of patches to work through is getting larger at the same time. Those two pressures pull against each other, and closing the gap is now the main job of vulnerability management rather than a byproduct of it.
Notable Vulnerabilities Beyond the Zero-Day
The exploited Outlook bug goes first, but it is not the most dangerous flaw in the release. Several Critical issues this month are reachable over the network and hit the systems that hold an environment together. Treat this as the watch list for the days after you clear the zero-day.
- Windows Search, CVE-2026-116928. A remote code execution flaw rated CVSS 9.8 that is reachable through Exchange Server. Dustin Childs called it a zero-click code execution bug on a high-value target, and more serious than any of the nine Exchange fixes this month. No user action is needed, which puts it near the top of the list.
- Windows LDAP, CVE-2026-119958. A remote code execution flaw also rated 9.8. Childs warned it could be destructive on domain controllers, where a single compromise reaches the whole domain.
- Active Directory Domain Services. CVE-2026-118146 (remote code execution) and CVE-2026-118148 (elevation of privilege, CVSS 8.8). Both belong in the domain controller patch window.
- Schannel, CVE-2026-119952. Remote code execution, CVSS 8.1, reachable by an unauthenticated attacker over the network. Schannel is the Windows component behind TLS, so this touches a lot of services.
- CredSSP, CVE-2026-119962. Remote code execution in the component behind Remote Desktop authentication.
- Exchange Server, CVE-2026-118207. Remote code execution, CVSS 8.8, flagged Exploitation More Likely. Patch internet-facing Exchange first.
- SharePoint Server, CVE-2026-120002. Rated only Important, but scored CVSS 9.9. It is the sharpest case this month of a severity label underselling the real risk.
- Hyper-V. Eight Critical elevation of privilege flaws (CVE-2026-113753, CVE-2026-113856, CVE-2026-113860, CVE-2026-113861, CVE-2026-113864, CVE-2026-113865, CVE-2026-119947, and CVE-2026-119960). On a Hyper-V host, an escape from one guest can reach the others, so these matter wherever workloads share hardware.
- Network-facing services. Critical remote code execution flaws also landed in Message Queuing, SMB (srvnet.sys), TCP/IP, NAT (CVSS 8.1, Exploitation More Likely), and RPC Runtime. Patch these wherever the service is exposed.
What the Security Industry Is Saying
We read the main trackers each month and note where they agree and where they differ. This month they agree on the headline: the count is enormous, and the fix order should come from exploitation and exposure, not from the severity labels.
Zero Day Initiative, Dustin Childs. Childs made the point that a low exploited-zero-day count is not good news on its own. Fewer zero-days in the wild reflects a change in attacker method, not a drop in attacks. He singled out the Windows Search flaw reachable through Exchange as the one to watch, and flagged the LDAP bug as especially dangerous on domain controllers.
Tenable, Satnam Narang. Tenable counted 1,093 rated CVEs and confirmed the single exploited Outlook flaw. Their write-up is also where the detail surfaced that the Outlook bug was credited to a researcher who used Claude.
Qualys. Qualys put the broader total at 1,235 once Edge and other republished fixes are counted, and noted only one vulnerability under active exploitation. Their guidance stayed on timely, risk-ordered patching as volume holds at this level.
Rapid7. Rapid7 led with the Outlook spoofing flaw, describing the NTLM leak that follows from merely opening a crafted file, and noted that all supported versions of classic Outlook receive the patch.
The message is the same as the last few months. Lead with what is proven to be exploited, then what is reachable, and treat the rest as a phased rollout rather than a single emergency.
It is worth being plain about what Childs means, because it changes how you act on it. When a patch ships, the fix itself shows exactly what was broken. AI now makes it fast to work backward from a patch to a working exploit. So an attacker does not have to spend a rare zero-day. They can wait for Patch Tuesday, build an exploit for a flaw Microsoft just disclosed, and use it against every organization that has not installed the update yet. The vulnerability is patched in the sense that a fix exists, but it is still open on most networks for days or weeks. That window, between a fix shipping and a fix deployed, is where the exploitation is moving, and it is why how fast you deploy now matters more than whether a bug started as a true zero-day.
Beyond Microsoft
Microsoft is the headline, but it was not the most severe release of the week. Several other vendors shipped on the same day, and two of them matter as much as anything in the Microsoft list.
- SAP had the most dangerous release of the week. Its November Security Patch Day fixed about 35 vulnerabilities, including four rated the maximum CVSS 10.0, all of them exploitable without authentication or user interaction. They sit in NetWeaver, Web Dispatcher, and Gateway, the network-facing pieces that often sit at the edge of a corporate network. One, a memory corruption flaw in Web Dispatcher that Onapsis named ICM2Shell, can lead to remote code execution. If you run SAP, these outrank most of the Microsoft list.
- Google Chrome 157 shipped a high-severity zero-day in an XML component, CVE-2026-125350, that is being exploited in the wild. For a general workforce that is as urgent as the Outlook flaw, and it sits outside the Microsoft release where a Patch-Tuesday-only process will miss it.
- Adobe released nine bulletins covering about 110 CVEs, 22 of them Critical, including a CVSS 9.9 flaw in Experience Manager. None were known to be exploited at release.
- Oracle shipped fixes for several Critical flaws this month, including a CVSS 9.8 bug in Identity Manager and a SOA Suite update where all fifteen fixes were Critical.
- Mozilla Firefox 160 addressed 99 CVEs, 57 of them rated High. None were reported as exploited.
The pattern from earlier in the year holds. A patch program scoped to Microsoft alone misses two of this week's most serious items: the Chrome zero-day that is already being exploited, and SAP's four unauthenticated CVSS 10.0 flaws. Patch Tuesday is a Microsoft event, but the risk in any given month does not stop at the vendor line.
Nobody Is Reading 1,094 Advisories
At this volume, the monthly count has stopped being a useful measure of risk. No team is going to read 1,094 advisories, rank them by hand, and patch in order. The count tells you the workload is large. It does not tell you what to do first.
A better way to sort the release is to ask four questions of each flaw, in order:
- Is it being attacked? Confirmed exploitation and a spot on the CISA KEV list outrank everything else. This month that is CVE-2026-124194 in Outlook and the Chrome zero-day.
- Can it be reached? A Critical flaw on an internet-facing or widely reachable system is a different problem from the same flaw on an isolated one. Reachability, not CVSS, decides the real exposure.
- Is it part of a chain? A privilege escalation that is useless on its own becomes the second step of a breach when paired with a foothold. The 535 elevation-of-privilege flaws this month matter in that context.
- Does it sit under the business? A domain controller, an authentication server, or an Exchange box carries more weight than a spare workstation. The same CVE is not the same risk on both.
That is the logic a modern program has to run on, because the raw number no longer fits in a human triage process. Doing that sorting automatically, across the whole environment, is where our platform comes in.
Where Brinqa Fits in This Environment
Those four questions are the job, and Brinqa answers them across your whole environment at Patch Tuesday speed. The CyberRisk Graph pulls findings from the scanners you already run, such as Tenable, Qualys, Rapid7, and Microsoft Defender, and correlates them against asset context, reachability, ownership, and live exploit activity. That is what turns a list of 1,094 CVEs into a ranked set of things to fix.
Against a release this size, that means:
- AI Deduplication Agent. Collapses the same flaw reported by three scanners into one finding with full source attribution, not three tickets.
- AI Exploitability Agent. Finds the exposures an attacker could actually chain, so the 535 privilege-escalation flaws this month get sorted by real risk.
- Context-aware scoring. Knows which Exchange box is internet-facing and which domain controller sits under a privileged account, and ranks them accordingly.
- SmartFlows routing and validation. Sends each fix to an owner, enforces the SLA, and confirms it took, including the Office builds that Windows patch status hides.
This is not about more scanning. You already have plenty of findings. It is about turning them into a short, owned list of work and confirming it got done.
Five Recommendations Before the December Window
1. Patch the Outlook flaw first, through the Office channels. CVE-2026-124194 is the one being exploited. Push it on every machine running Outlook, and remember the fix is in the Office updates, not the Windows cumulative update. Verify the Office build directly so a patched Windows machine does not read as done when it is not.
2. Harden the systems that hold the environment together. Right behind Outlook, patch the domain controllers and authentication servers for the LDAP, Schannel, CredSSP, and Active Directory flaws, and move on internet-facing Exchange, IIS, and SharePoint next. A compromise here reaches everything else.
3. Pull the Chrome zero-day into the same wave. The Chrome 157 fix closes a flaw that is already being exploited. For a general workforce, that is as urgent as the Outlook bug, and it sits outside the Microsoft release where a Patch-Tuesday-only process will miss it.
4. Stop ranking by severity label. The SharePoint flaw scored 9.9 while rated only Important, and the exploited Outlook bug is rated Moderate. Rank by exploitation, reachability, chaining, and business role instead. If your dashboards still lead with Critical counts, that is the metric to change.
5. Plan for December to be large too. Three months in a row have landed near or above 1,000 CVEs, and there is no sign of that easing. Build your capacity and your automation for a four-figure release as the normal case, not the exception. The next Patch Tuesday is December 8.
Get Ahead of the December Release
The next Patch Tuesday is December 8, and there’s no sign the volume is easing. See how Brinqa turns a four-figure release into a short, owned list of work, ranked by exploitation, reachability and business context, with every fix confirmed.
FAQs
Microsoft's November release addresses 1,094 CVEs, with 726 in Windows and 174 in Office. Of the 1,093 that carry a severity rating, 63 are Critical. Microsoft also republished 165 non-Microsoft CVEs, and Google shipped a separate batch of Edge and Chromium fixes.
CVE-2026-124194, the exploited Outlook spoofing flaw. It ships through the Office update channels, not the Windows cumulative update, and CISA set a federal deadline of November 24. The actively exploited Chrome 157 zero-day belongs in the same first wave.
Because exploitation, not count, measures risk. The Outlook flaw is rated only Moderate but it is the one attackers are using, and it quietly leaks a user's NTLMv2 password hash when a crafted file is opened.
No. The Zero Day Initiative reads the lower count as a change in attacker method, not less activity. AI is proving effective at reverse-engineering patches after release, so the pressure is shifting toward fast exploitation of freshly patched flaws.
Each tracker draws the line differently. The core Microsoft figure is 1,094. Tenable reports 1,093 rated CVEs, and Qualys reports 1,235 once Edge and other republished fixes are included.
Brinqa correlates findings from your existing scanners against asset, reachability, ownership, and exploit context, deduplicates across tools, ranks by real risk, routes each fix to an owner, and validates that it took. It turns a 1,094-CVE list into a short, ordered, owned set of work.
December 8, 2026.
Sources and References
- Splashtop, November 2026 Patch Tuesday: Outlook zero-day leads 1,094 CVEs
- Tenable, Microsoft's November 2026 Patch Tuesday Addresses 1,093 CVEs (CVE-2026-124194)
- CyberScoop, Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday
- Dark Reading, November Patch Tuesday Offers an Overflowing Cornucopia of CVEs
- SOCRadar, November 2026 Patch Tuesday: 1,094 Flaws, One Exploited
- Rapid7, Patch Tuesday November 2026
- Qualys, Microsoft and Adobe Patch Tuesday, November 2026 Security Update Review
- Action1, Patch Tuesday November 2026
- CSO Online, November 2026 Patch Tuesday: 63 Critical Microsoft fixes, plus an Outlook zero day
- BleepingComputer, SAP patches ICM2SHELL and PROXYGATE maximum severity flaws
- Action1, Vulnerability Digest November 2026: Third-Party Updates (Adobe, Oracle)
- Brinqa Research, October 2026 Patch Tuesday analysis (prior edition)
Counts reflect the figures reported as of November 12, 2026. Where trackers differ, we use the 1,094 core Microsoft figure. CVE identifiers and CVSS scores are drawn from vendor advisories and the trackers above; confirm against Microsoft's Security Update Guide before deployment.
