November 2026 Patch Tuesday: 1,240 CVEs, and Outlook Goes First

Microsoft shipped fixes for 1,240 CVEs on 10 November 2026, and 64 of them are rated critical. Before your change board even meets, two of those flaws are already being exploited: an Outlook spoofing bug and a Chromium use-after-free. The Readiness team's verdict is blunt — Windows, Office, Exchange and Microsoft browsers go on a Patch Now schedule, with the Outlook fix first in the queue.

What does the exploited Outlook flaw actually do?

CVE-2026-124194 is the one that should worry your messaging team. A crafted message file makes Outlook connect to an attacker's server without the external-content warning — and hand over the user's NTLMv2 hash. The Preview Pane isn't an attack vector, but Microsoft 365 Apps, Office LTSC 2021 and LTSC 2024 are all exposed.

The second active exploit, CVE-2026-125350, sits in Chromium. Google flagged it as exploited on 9 November and fixed it in Chrome 157.0.8103.50. Microsoft's Edge fix, as of 11 November, ships only in Edge for Android (157.0.4341.53). When the desktop Edge fix lands, deploy it without waiting for a pilot ring.

Where do the Windows risks concentrate?

Windows accounts for 744 CVEs — 60% of the month — with 37 critical and 38 rated "Exploitation More Likely." The priorities:

• Three unauthenticated critical RCEs: CVE-2026-119958 in LDAP, CVE-2026-116928 in Windows Search and CVE-2026-112967 in Xbox Live Networking Service. The Search flaw is the nastiest — Exchange can trigger it by indexing a crafted attachment before anyone opens the email.
• Domain controllers first: CVE-2026-118146 (RCE) and CVE-2026-118148 (EoP) in AD DS, plus Kerberos flaw CVE-2026-85844, which lets an unauthenticated attacker take SYSTEM on a DC despite its "important" rating.
• Schannel (CVE-2026-119952) and NAT (CVE-2026-113862), both critical RCEs rated likely to be exploited.
• Hyper-V (16 fixes, 8 critical), Message Queuing (5 critical RCEs), DNS (33 fixes) and DHCP Server (9), each including an unauthenticated RCE.

What's the Exchange and SQL Server picture?

Exchange Server Subscription Edition gets nine CVEs in one update, KB5133453 — one critical RCE (CVE-2026-118207) requiring an authenticated attacker. SQL Server carries 54 important CVEs across four branches, with unauthenticated RCE CVE-2026-116945 hitting all of them; check Always On availability groups after installing.

For anyone still on Exchange 2016 or 2019, there's no update at all. Microsoft's release note doesn't hedge: "If you are using those versions of Exchange, you should consider them permanently vulnerable and should upgrade your organization immediately."

Which bugs came back from the dead?

Between Patch Tuesdays, Microsoft published or revised 1,818 CVEs in the MSRC guide — 1,451 of them Chromium entries republished for Edge. Several revisions sting:

• CVE-2026-70197, a .NET and Visual Studio RCE, was reopened on 19 October because the October fix didn't work. This month completes it.
• CVE-2026-111497, an out-of-bounds write in the .NET Brotli decoder, is rated critical by Microsoft but listed as exploited by CISA. Trust CISA on this one.
• CVE-2026-83844, an RCE in Windows Paint, now needs Paint build 11.2609.401.0.
• Nine July–September Windows CVEs now also affect Office editions — if you patched Windows but deferred Office, you're still exposed.

What fell out of support?

10 November closed the books on Windows 11 Enterprise, Education and IoT Enterprise 23H2 (KB5131087 is the last update), .NET 8 and 9, and PowerShell 7.4 and 7.5. Next up: Windows Server 2016 and Windows 10 Enterprise LTSC 2021 on 12 January 2027.

One behavioral change deserves a test pass: Windows clients now offer NTLM message signing by default, phase one of a plan that has servers rejecting non-signing clients from May 2027 (KB5135557). With printing carrying 57 of this month's 71 high-risk flags, run print, scan and font tests — plus network discovery, Kerberos/NTLM, Remote Desktop and Storage Spaces — before wide rollout.

Good news to close on: the November Windows 11 updates list zero known issues, and last month's Exchange mail-flow breakage is fixed. Small mercies, 1,240 CVEs at a time.