Microsoft November patches cover 1,260 flaws, one Outlook bug exploited
SANS says 68 issues are critical and CVE-2026-124194, an Outlook spoofing bug, is already exploited.
76
Vulnerability1 · 1 read
CVE-2026-113859
Use-after-free in Windows TCP/IP over adjacent network
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A use-after-free in Windows TCP/IP lets an unauthorized attacker run code. The attacker must be on an adjacent network; no account or user interaction is required, though the attack is hard to carry out. Successful exploitation yields high impact on confidentiality, integrity, and availability. Microsoft has not listed affected builds.
What to do: Apply Microsoft's update for CVE-2026-113859. No workaround is stated.
| Product | Affected |
|---|---|
| Microsoft Windows TCP/IP | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network.
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
2 storiesMicrosoft November 2026 update fixes 1,093 flaws, one Outlook zero-day
Opening a crafted file can leak an NTLMv2 hash; the Preview Pane is not an attack vector.
74