Overview
Microsoft's November 2026 Patch Tuesday is another four-digit release: 1,093 vulnerabilities fixed across Windows and supported software, as reported by KrebsOnSecurity. Dark Reading's coverage highlights an actively exploited Outlook zero-day alongside critical Exchange, SharePoint, Windows Search, and LDAP bugs.
By the Numbers
- 63 critical flaws, nearly half of them remote code execution
- 535 privilege escalation flaws
- More than 5,100 security patches from Microsoft so far in 2026, versus roughly 100 per month a year ago; Microsoft credits AI-assisted bug discovery for the surge
The Zero-Day
CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook and the only flaw Microsoft lists as actively exploited this month. It affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office. Prioritize it first.
Other Vendor Updates
- Apple: Out-of-cycle updates fix at least nine vulnerabilities across iOS/iPadOS, macOS, watchOS and visionOS, including two iMessage group chat flaws: one lets a remote attacker join a group and receive its messages, another exposes messages sent before a user joined.
- Google Chrome 157.0.8103.50: Fixes nine security holes, including CVE-2026-125350, the sixth Chrome zero-day of 2026. Chromium-based browsers such as Edge are affected too.
- Mozilla Firefox 160: Resolves almost 100 CVEs, about half rated high severity.
- Adobe: Patches at least 110 vulnerabilities, nearly half rated high, with no evidence of active exploitation.
Context for Defenders
Ivanti's Chris Goettl notes about 95,000 CVEs were assigned this year across all vendors, but only 217 were added to CISA's KEV catalog. Roughly 40% of exploited flaws are in operating systems, endpoint software, browsers and server platforms, while about 44% are in edge devices, IT management tools, or remote access tools, which call for exposure management alongside patching.
Recommended Actions
- Deploy the Outlook / Office fix for CVE-2026-124194 immediately.
- Prioritize critical Exchange, SharePoint, Windows Search, and LDAP updates on exposed or high-value servers.
- Update Chrome and Edge, and verify Apple devices actually installed the out-of-cycle updates rather than assuming auto-update worked.
- Back up important data before applying OS updates.
- Pair patching with exposure management for edge and remote-access tooling.