Microsoft November 2026 patches fix 1235 flaws, one exploited in Outlook
CISA added Outlook spoofing flaw CVE-2026-124194 to KEV and set a November 24, 2026 patch deadline.
76
CVE-2026-119951
Use-after-free in Windows Deployment Services
- CVSS 3.1
- 8.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A use-after-free flaw in Windows Deployment Services lets an unauthorized attacker run code over the network. No user interaction or prior access is required. Successful exploitation gives the attacker code execution on the affected system. Systems running the Windows Deployment Services role are affected; Microsoft has not listed affected builds.
What to do: Apply Microsoft's update for CVE-2026-119951. No workaround is stated.
| Product | Affected |
|---|---|
| Microsoft Windows Deployment Services | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H