ZDI lists November 2026 Microsoft fixes, one Outlook bug exploited
Original title: The November 2026 Security Update Review
CVE-2026-124194 is the only listed flaw marked exploited; it is a Moderate CVSS 6.5 spoofing bug.
Trend Micro’s Zero Day Initiative published its review of Microsoft’s November 2026 security updates as a large vulnerability table. CVE-2026-124194, a Microsoft Outlook spoofing flaw rated Moderate at CVSS 6.5, is marked exploited but not public. The excerpt also lists many unexploited Critical issues, including remote code execution in Office, Exchange, LDAP, and Windows components, plus privilege escalation in Azure services and Hyper-V.
Unconfirmed: The excerpt does not identify attackers, victims, or the scale of exploitation.
- Azure OpenAI and Azure Managed Grafana privilege bugs are Critical at CVSS 9.8 and not exploited.
- Windows LDAP remote code execution CVE-2026-119958 is Critical at CVSS 9.8 and not exploited.
- Exchange Server RCE CVE-2026-118207 is Critical at CVSS 8.8 and not marked exploited.
- The visible table lists numerous Critical Excel, Word, Outlook, and Office remote code execution fixes.
Impact: Exploited Outlook spoofing, plus unexploited critical code execution
| Product | Affected |
|---|---|
| Microsoft Outlook | — |
| Microsoft Office Excel | — |
| Microsoft Exchange Server | — |
| Microsoft Windows LDAP | — |
| Microsoft Azure OpenAI | — |
| Microsoft Azure Managed Grafana | — |
- 1.Install the applicable November 2026 Microsoft security updates for deployed products.
- CVEs
- CVE-2026-124194CVE-2026-118148CVE-2026-114160CVE-2026-119990CVE-2026-119969CVE-2026-122194CVE-2026-118207CVE-2026-118292CVE-2026-118296CVE-2026-118297CVE-2026-118701CVE-2026-118702CVE-2026-118711CVE-2026-118713CVE-2026-118730CVE-2026-120786CVE-2026-120788CVE-2026-120789CVE-2026-124170CVE-2026-110043CVE-2026-110068CVE-2026-111309CVE-2026-111289CVE-2026-120003CVE-2026-110047CVE-2026-110067CVE-2026-111285CVE-2026-124185CVE-2026-120005CVE-2026-113749
- Vendors
- Microsoft
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-110043+2 related CVEs | Heap buffer overflow in Microsoft Outlook via network | 8.8 | — | ||
CVE-2026-110047+3 related CVEs | Use-after-free in Microsoft Office Word (user interaction) | 8.8 group max | — | ||
CVE-2026-124194+2 related CVEs | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 group max | — | KEV | KEV |
| CVE-2026-113749 | Heap buffer overflow in Windows Codecs Library | 7.5 | — | ||
| CVE-2026-114160 | Unauthenticated privilege elevation in Azure Managed Grafana | 9.8 | — | ||
| CVE-2026-118148 | Privilege escalation in Active Directory Domain Services | 7.5 | — | ||
| CVE-2026-118207 | Authenticated remote code execution in Exchange Server | 8.8 | — | ||
| CVE-2026-118292 | Stack buffer overflow in Microsoft Excel (user opens content) | 8.8 group max | — | ||
| CVE-2026-119969 | Heap buffer overflow in Microsoft Graphic Fonts | 8.8 | — | ||
| CVE-2026-119990 | Missing authentication in Azure OpenAI enables privilege elevation | 9.8 | — | ||
| CVE-2026-120005 | Heap buffer overflow in Microsoft Office PowerPoint | 8.8 | — | ||
| CVE-2026-122194 | Null pointer dereference RCE in Microsoft Defender | 8.8 | — |
From the original article
12 min read at thezdi.com
The penultimate month of 2026 bring with it the usual storm of patches from Microsoft and Adobe. I’ve been prototyping some new ways to display this data, but as always, I’m open to suggestions. Seriously – hit me up on Bluesky if you have any ideas.
By Dustin Childs · thezdi.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.