Microsoft November 2026 patches critical RCEs and an exploited Outlook flaw
Original title: Microsoft November 2026 Patch Tuesday Addresses Critical RCE Flaws and Outlook Zero-Day Attacks
Only CVE-2026-124194, a moderate Outlook spoofing bug, is marked exploited; builds and fixes are not listed.
Microsoft's November 2026 Patch Tuesday covers a long list of critical remote-code-execution and elevation-of-privilege flaws in Windows, Office, Exchange, Hyper-V and Azure services. CVE-2026-124194, a moderate Microsoft Outlook spoofing vulnerability, is the only entry labeled exploited. The excerpt gives no affected builds, fixed versions or details of the Outlook attacks.
Unconfirmed: Only CVE-2026-124194 is labeled exploited; the excerpt gives no attack details or patch builds.
- Critical RCEs are listed in Excel, Word, Outlook, PowerPoint and Exchange Server.
- Other critical issues affect IIS, LDAP, Message Queuing, CredSSP and the graphics kernel.
- Azure Managed Grafana and Azure OpenAI have critical elevation-of-privilege flaws.
- The Windows Print Spooler entry is cut off, so its details are incomplete.
Impact: Outlook spoofing plus critical remote code execution and privilege elevation
| Product | Affected |
|---|---|
| Microsoft Outlook | — |
| Microsoft Windows Active Directory Domain Services | — |
| Microsoft Azure Managed Grafana | — |
| Microsoft Azure OpenAI | — |
| Microsoft Defender | — |
| Microsoft Exchange Server | — |
| Microsoft Office | — |
| Microsoft Windows Hyper-V | — |
| Microsoft Windows Internet Information Services | — |
| Microsoft Windows Message Queuing | — |
- 1.Install Microsoft's November 2026 security updates for the listed products.
- CVEs
- CVE-2026-124194CVE-2026-118146CVE-2026-118148CVE-2026-114160CVE-2026-119990CVE-2026-119969CVE-2026-122194CVE-2026-118207CVE-2026-111289CVE-2026-120003CVE-2026-118292CVE-2026-118296CVE-2026-118297CVE-2026-118701CVE-2026-118702CVE-2026-118711CVE-2026-118713CVE-2026-118730CVE-2026-120786CVE-2026-120788CVE-2026-120789CVE-2026-124170CVE-2026-110043CVE-2026-110068CVE-2026-111309CVE-2026-120005CVE-2026-110047CVE-2026-110067CVE-2026-111285CVE-2026-124185
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-110043+2 related CVEs | Heap buffer overflow in Microsoft Outlook via network | 8.8 | — | ||
CVE-2026-110047+3 related CVEs | Use-after-free in Microsoft Office Word (user interaction) | 8.8 group max | — | ||
CVE-2026-124194+2 related CVEs | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 group max | — | KEVPoC | KEV |
| CVE-2026-114160 | Unauthenticated privilege elevation in Azure Managed Grafana | 9.8 | — | ||
CVE-2026-118146+1 related CVE | Incorrect authorization in Active Directory Domain Services | 8.8 group max | — | ||
| CVE-2026-118207 | Authenticated remote code execution in Exchange Server | 8.8 | — | ||
| CVE-2026-118292 | Stack buffer overflow in Microsoft Excel (user opens content) | 8.8 group max | — | ||
| CVE-2026-119969 | Heap buffer overflow in Microsoft Graphic Fonts | 8.8 | — | ||
| CVE-2026-119990 | Missing authentication in Azure OpenAI enables privilege elevation | 9.8 | — | ||
| CVE-2026-120005 | Heap buffer overflow in Microsoft Office PowerPoint | 8.8 | — | ||
| CVE-2026-122194 | Null pointer dereference RCE in Microsoft Defender | 8.8 | — |
From the original article
9 min read at gbhackers.com
Microsoft released its November 2026 Patch Tuesday updates, addressing 1,093 newly disclosed vulnerabilities across Windows, Office, SQL Server, SharePoint, Exchange Server, Azure services, and developer tools. The release includes 63 Critical flaws, 1,029 Important issues, and one Moderate vulnerability, including an actively exploited Outlook zero-day that exposes authentication information.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.