Summary
Microsoft's November 2026 Patch Tuesday (November 10) is another four-digit release. According to KrebsOnSecurity, the company fixed 1,093 vulnerabilities across Windows and supported software. About 5,100 patches have shipped so far this year, versus roughly 100 per month a year earlier. Microsoft credits AI-assisted discovery tools for much of the increase.
Dark Reading's coverage also highlights critical Exchange, SharePoint, Windows Search, and LDAP bugs that defenders should prioritize.
Key Numbers
| Metric | Count |
|---|---|
| Total vulnerabilities fixed | 1,093 |
| Rated critical | 63 (nearly half are remote code execution) |
| Elevation of privilege | 535 |
| Actively exploited zero-days | 1 |
Counts differ between outlets: BleepingComputer cites 1,235 vulnerabilities across Microsoft products for the same release, likely a different counting method. Check Microsoft's Security Update Guide for the authoritative list.
The Exploited Zero-Day
CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook and the only flaw reported as actively exploited. It affects Microsoft 365 Apps for Enterprise and Microsoft Office editions. Public details on the exploitation are limited.
Other Vendors This Week
- Apple: Out-of-cycle updates fixed at least nine vulnerabilities across iOS/iPadOS, macOS, watchOS, and visionOS, including iMessage group chat flaws. The fix was backported to iOS 18.
- Google Chrome: Version 157.0.8103.50 fixed nine flaws, including CVE-2026-125350, Chrome's sixth zero-day this year. Edge and other Chromium browsers are also patching it.
- Mozilla Firefox: Version 160 fixed almost 100 CVEs, about half rated high.
- Adobe: Updates cover at least 110 vulnerabilities, with no evidence of active exploitation.
Prioritization Context
Ivanti's Chris Goettl notes that about 95,000 CVEs were assigned this year, but only 217 have reached CISA's Known Exploited Vulnerabilities list. Roughly 40% of exploited flaws affect operating systems, endpoints, browsers, and servers, while about 44% affect edge devices and remote access or IT management tools.
Recommended Actions
- Patch the Outlook zero-day first, on Microsoft 365 Apps and Office installs.
- Prioritize internet-facing Exchange and SharePoint servers, then Windows Search and LDAP-related fixes.
- Update Chrome, Edge, Firefox, and Apple devices.
- Back up important data before applying OS updates, and stage rollouts in rings.