Microsoft November patches cover 1,260 flaws, one Outlook bug exploited
Original title: Microsoft Patch Tuesday November 2027 , (Tue, Nov 10th)
SANS says 68 issues are critical and CVE-2026-124194, an Outlook spoofing bug, is already exploited.
The SANS Internet Storm Center's November Patch Tuesday diary says Microsoft addressed 1,260 vulnerabilities, 68 of them critical. Of those, 167 are Chromium issues affecting Microsoft Edge. CVE-2026-124194, an Outlook spoofing flaw, is already being exploited. The diary also flags critical remote code execution in Microsoft LDAP, several critical flaws in Microsoft Queuing and Queue Manager, and a Windows TCP/IP remote code execution bug scored 7.5.
Unconfirmed: The diary title says November 2027, while the post is dated November 10, 2026, and the identifiers are CVE-2026.
- 167 of the flaws are Chromium issues in Microsoft Edge.
- CVE-2026-119958 is a critical remote code execution bug in Microsoft LDAP.
- Five critical issues are listed in Microsoft Queuing and Queue Manager.
- CVE-2026-113859 is Windows TCP/IP remote code execution with a 7.5 CVSS score.
Impact: Outlook spoofing already exploited; other critical RCEs patched
| Product | Affected |
|---|---|
| Microsoft Outlook | — |
| Microsoft Edge | — |
| Microsoft LDAP | — |
- 1.Install Microsoft's November security updates, including the Outlook fix.
- CVEs
- CVE-2026-124194CVE-2026-119958CVE-2026-109459CVE-2026-119967CVE-2026-116710CVE-2026-119963CVE-2026-119964CVE-2026-113859
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109459+4 related CVEs | Heap buffer overflow in Windows Message Queuing Queue Manager | 8.1 | — | ||
| CVE-2026-113859 | Use-after-free in Windows TCP/IP over adjacent network | 7.5 | — | ||
| CVE-2026-119958 | Unauthenticated remote code execution in Windows LDAP | 9.8 | — | ||
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEVPoC | KEV |
From the original article
12 min read at isc.sans.eduMicrosoft continues its AI-induced patch surge, addressing 1,260 different vulnerabilities this month. 68 of these vulnerabilities are considered critical. 167 of the vulnerabilities are Chromium issues affecting Microsoft Edge.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.