For November, Patch Tuesday means a to-do list that starts with Outlook

November is a (relatively) big month. Microsoft’s November 2026 Patch Tuesday fixes 1,240 CVEs, 64 of them rated critical. Start with Outlook: attackers are already using CVE-2026-124194, a spoofing flaw. A Chromium flaw, CVE-2026-125350, is also being exploited, and at the time of writing, Microsoft has fixed it only in Edge for Android. The Readiness team recommends that Windows, Office, Exchange and Microsoft browsers are included in a Patch Now schedule. SQL Server and Microsoft developer tools can follow your standard release schedule. Our infographic shows the deployment risk for each product family. Our count takes Microsoft’s 1,094 CVEs, adds 165 republished Chromium fixes and leaves out 19 Azure and open-source entries.

Known issues

Good news first: the November Windows 11 updates list no known issues. The three updates are KB5132061, KB5132059 and KB5131087. Several older issues also close this month:

On-premises Exchange had a rough October. After the October Windows Server updates, some servers lost Outlook on the web sign-in, left mail in the Outbox or failed mailbox replication. The November server updates fix this: KB5131080 for Windows Server 2025 and KB5131090 for Windows Server 2022. Windows Server 2019 gets KB5131085, and Windows Server 2016 gets KB5131291.

Some USB Audio Class 1.0 devices that have failed with error code 10 since 8 September should start again.

Adding a printer published in Active Directory through Settings works again, after failing with error 87 since October.

KB5132061 fixes two October issues on Windows 11 24H2. Smart App Control can be turned back on, and non-admin Remote Desktop works again with Administrator protection enabled. 25H2 and 26H2 already had both fixes from the 28 October preview. That preview was KB5127936.

One Windows Server issue stays open. WSUS still hides synchronization error details on Windows Server 2025 and 2022. Microsoft made that change to address CVE-2025-59287, and there is no published workaround. If a sync fails, WSUS will not tell you why.

Outside Windows, one issue carries over and one is new:

SQL Server 2022 CU27 (KB5129300) and SQL Server 2025 CU10 (KB5129299) still list an access violation when querying sys.dm_exec_requests during database recovery. It has been listed since 16 July. Until a fix arrives, Microsoft suggests trace flag 4696.

Upgrading the ASP.NET Core Hosting Bundle from 8.0.33 or 9.0.22 may leave the previous ASP.NET Core Module installed. Microsoft notes this in the .NET 8.0.34 and 9.0.23 updates, KB5135243 and KB5135242.

Major revisions and mitigations

Between the two Patch Tuesdays, Microsoft published or revised 1,818 CVEs in the MSRC Security Update Guide, not counting Azure Linux. Most of them, 1,451, were Chromium entries republished for Microsoft Edge.

That leaves 365 Microsoft CVEs and two third-party .NET entries, mostly housekeeping. These are worth your time:

CVE-2026-70197, a .NET and Visual Studio remote code execution flaw, reopened on 19 October because the October fix had not addressed it. This month’s .NET and Visual Studio updates include the full fix.

CVE-2026-111497 is an out-of-bounds write in the .NET Brotli decoder, fixed in the out-of-band .NET updates of 25 October. Microsoft rates it critical but not exploited. CISA lists it as exploited, and I’d go with CISA. Only applications that use Brotli decompression are exposed, and it is off by default.

CVE-2026-83844, a remote code execution flaw in Windows Paint (yes, Paint), was revised on 6 November. A full fix needs Paint build 11.2609.401.0.

Nine Windows CVEs from July, August and September were revised on 28 October to add supported editions of Office to the affected products. If you patched Windows but deferred Office, you are still exposed.

On 26 October, Edge was added to the affected products of 11 CVEs. One is CVE-2026-96951, the Windows Shell security feature bypass exploited in October.

Microsoft has already changed this November release too, altering 18 CVE records within 11 hours. Only one change carries a revision note. CVE-2026-95885, in the Windows Client for NFS, is now remote code execution, though its title still says elevation of privilege. CVE-2026-119991, in Configuration Manager, left the Windows product family. Our figures use Microsoft’s data on 11 November.

Windows lifecycle and enforcement updates

Patch Tuesday, 10 November 2026, was also the last day of support for several products:

Windows 11 Enterprise and Education 23H2 and Windows 11 IoT Enterprise 23H2 have reached the end of updates. KB5131087 is the last update for these editions.

.NET 8 and .NET 9 are out of support. Their last updates, 8.0.34 and 9.0.23, shipped on the day support ended.

PowerShell 7.4 and 7.5 are out of support too. This month’s fixes for PowerShell 7 are listed for 7.6 and 7.7 only.

Next, on 12 January 2027, Windows Server 2016 and Windows 10 Enterprise LTSC 2021 reach the end of support. There is no non-security preview update in December 2026.

Several security changes alter existing behavior, including:

NTLM signing. Windows clients now offer NTLM message signing by default for non-anonymous connections. This is phase one. In May 2027, Windows servers will start requiring it and rejecting clients that do not offer it (KB5135557).

PowerShell script signing. Signed scripts with invalid UTF-8 may now fail validation until they are saved as UTF-8 with a byte order mark and signed again.

RD Web Access. On Windows Server, pages are now rendered on the server and no longer depend on XSLT support in the browser.

Windows Deployment Services. On Windows Server, the Import-WdsInstallImage cmdlet now requires administrator rights. Running it without them fails with an ACCESS_DENIED error.

With printing as the testing focus this month, we recommend a full test cycle on the following areas:

Printing, scanning and fonts. This area carries 57 of the 71 high-risk flags, so start here. Print mixed-font and non-English documents to a physical printer, Microsoft Print to PDF and the XPS Document Writer. Add and remove printers over IPP, WSD, USB and TCP/IP, and scan from eSCL, WSD and USB scanners.

Network discovery and device association (10 high-risk flags). Check that shared folders, printers, UPnP and WSD devices appear, disappear and come back as a single entry.

Kerberos, NTLM and AuthIP (three high-risk flags). Test NTLM connections by IP address between updated machines with the new signing settings. Then work out which failures are intended.

Remote Desktop (one high-risk flag). Connect with clipboard, drive, printer and smart card redirection, then disconnect and reconnect.

Storage, Windows Installer and SQL Server. Test degraded Storage Spaces pools on hardware you can recover. Test per-user MSI install and repair as a standard user, and the SQL Server GDR on each branch you run.

Each month, we group the rest by Microsoft’s product families. Worth mentioning is CVE-2026-122194, a critical flaw in the Defender malware protection engine, fixed in engine version 1.1.26100.4.

Browsers

Microsoft released 166 browser CVEs this month, and 165 are Chromium fixes republished for Edge. Four are critical, all memory safety flaws.

Most of the Chromium fixes ship in Edge 157.0.4341.42.

Microsoft’s own entry is CVE-2026-122518, an information disclosure flaw in Edge rated moderate.

On 9 November, Google said CVE-2026-125350, a use-after-free flaw in Chromium, is being exploited, and fixed it in Chrome 157.0.8103.50. Microsoft said it is working on an Edge fix. On 11 November it shipped the fix in Edge for Android (157.0.4341.53).

Add these updates to your Patch Now schedule. Confirm that managed Edge channels are on the current build. When the Edge fix for CVE-2026-125350 ships, I’d deploy it without waiting for a pilot ring.

Microsoft Windows

Windows has 744 CVEs this month, 60% of the total, and 37 of them are critical. Most are elevations of privilege. Microsoft rates 38 Windows entries as “Exploitation More Likely”.

Three critical remote code execution flaws need no authentication and score highest. They are CVE-2026-119958 in LDAP, CVE-2026-116928 in Windows Search and CVE-2026-112967 in the Xbox Live Networking Service. The Windows Search one is the nastiest. Exchange Server can trigger it by indexing a crafted attachment, without anyone opening the email.

Patch your domain controllers first. Active Directory Domain Services has two critical entries, both rated “Exploitation More Likely”. They are CVE-2026-118146, a remote code execution flaw, and CVE-2026-118148, an elevation of privilege. Don’t be fooled by the important rating on CVE-2026-85844 in Kerberos. It lets an unauthenticated attacker gain SYSTEM privileges on a domain controller.

Two more critical remote code execution flaws are rated “Exploitation More Likely”: CVE-2026-119952 in Schannel and CVE-2026-113862 in Network Address Translation.

Hyper-V has 16 fixes, eight of them critical elevations of privilege. Message Queuing has five critical remote code execution fixes.

Windows DNS has 33 fixes, 11 of them in the DNS Server role, and Windows DHCP Server has nine. Both include a remote code execution flaw that needs no authentication.

The most-patched components are the Windows Advanced Rasterization Platform (37) and Windows Installer (36). The Graphics Kernel, the Windows Kernel and the Print Spooler follow.

Windows goes on your Patch Now schedule. The Readiness team recommends domain controllers, DNS and DHCP servers first, then Hyper-V hosts.

Microsoft Office

Microsoft Office has 204 CVEs this month: 22 critical, 181 important and one moderate. That moderate one is the one that matters most.

CVE-2026-124194 is an Outlook spoofing flaw, and it is being exploited. A crafted message file makes Outlook connect to an attacker’s server without the external-content warning, leaking the user’s NTLMv2 hash. The Preview Pane is not an attack vector. It affects Microsoft 365 Apps, Office LTSC 2021 and Office LTSC 2024.

All 22 critical entries are remote code execution, 12 of them in Excel. For eight of them, including all three in Outlook, the Preview Pane is an attack vector.

Click-to-Run estates carry most of the work. Microsoft 365 Apps is affected by 174 of the Office CVEs, and 138 reach Office for Mac.

SharePoint Server Subscription Edition has 27 entries, all rated important, in KB5002945. The highest-scoring is CVE-2026-120002, an elevation of privilege that needs an authenticated attacker. Office Online Server has 56 Excel fixes.

This month, Office goes on your Patch Now schedule. Deploy the Outlook fix first.

Microsoft Exchange and SQL Server

Exchange has one critical CVE and SQL Server has none, but SQL Server’s top entry scores higher.

Exchange Server has nine CVEs, one critical, in a single update for Subscription Edition, KB5133453. The critical one, CVE-2026-118207, is a remote code execution rated “Exploitation More Likely” that needs an authenticated attacker. None of the nine is exploited or disclosed.

Exchange servers need this month’s Windows Server update too, for the mail-flow fix and the Windows Search flaw (CVE-2026-116928).

SQL Server has 54 CVEs, all rated important, across its four supported branches and the Microsoft.Data.SqlClient and JDBC drivers. The one to watch is CVE-2026-116945, a remote code execution that needs no authentication and affects all four branches.

There are eight packages, a CU and a GDR update for each branch. SQL Server 2025 gets KB5129299 and KB5132748. SQL Server 2022 gets KB5129300 and KB5132747. SQL Server 2019 gets KB5132745 and KB5132751. SQL Server 2017 gets KB5132746 and KB5132749. After installing, check that your Always On availability groups are healthy.

Exchange goes on your Patch Now schedule. If you are still on Exchange 2016 or 2019, there is no update for you, and Microsoft’s note on this month’s release is blunt:

“If you are using those versions of Exchange, you should consider them permanently vulnerable and should upgrade your organization immediately.”

SQL Server can follow your standard release schedule. Because of CVE-2026-116945, I’d start with instances that run integration packages against external endpoints.

Microsoft developer tools

The developer tools have 50 CVEs this month, all rated important.

The top-scoring entry is CVE-2026-109467 in Azure DevOps Server. A Project Reader can use it to run code on your pipeline agents.

Visual Studio Code has 19 entries, all fixed in version 1.145.3. The worst, CVE-2026-120779, needs a user to connect to a malicious MCP server and click a crafted link. I’d mention it to your developers.

ASP.NET Core has 13 entries and .NET five. The most serious is CVE-2026-114146, an ASP.NET Core elevation of privilege. The fixes ship in .NET 8.0.34 (KB5135243) and 9.0.23 (KB5135242). Versions 10.0.15 (KB5135241) and 11.0.0 carry them too.

Visual Studio has five remote code execution entries, fixed in Visual Studio 2026 versions 18.11.4 and 18.12.0. Visual Studio 2022 version 17.14.45 carries this month’s ASP.NET Core and .NET fixes.

PowerShell 7 has four information disclosure entries, fixed in 7.6.10 and 7.7.0.

.NET Framework has no CVEs this month.

Add these developer-focused updates to your standard release schedule. With .NET 8, .NET 9, and PowerShell 7.4 and 7.5 out of support, I’d plan the move to .NET 10 and PowerShell 7.6. This month’s .NET and Visual Studio updates also complete the fix for CVE-2026-70197.

Adobe (if you got this far)

We have now officially entered the age of vulnerability, and AI handed us the receipts. Another huge month, but the good news is that November’s count was lower than October’s. Not sure that this offers a quantum of solace for those dealing with more than 1,000 security vulnerabilities, but we may be seeing the “end of the beginning” of this new age. And I got it wrong this month: my model said 1,586 CVEs, and our count came to 1,240. That said, more than 1,800 CVEs were published or revised between the October and November Patch Tuesdays. So, yeah – lots, and more to come.ComputerworldRead More