Microsoft November 2026 patches fix 1095 flaws, one exploited
Original title: Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities
Only CVE-2026-124194, an Outlook spoofing bug scored 6.5, is exploited; 48 of 64 critical issues are remote code execution.
Microsoft’s November 2026 security update covers 1095 vulnerabilities, 64 of which Microsoft marked critical. Microsoft says CVE-2026-124194, an Outlook spoofing flaw in which the product UI does not warn users of unsafe actions, has been exploited. It also flags several remote code execution and elevation-of-privilege bugs in Windows, Active Directory, Exchange and other products as more likely to be exploited. Fixed version strings are not stated in the Talos summary.
- CVE-2026-124194 is a spoofing flaw in Microsoft Office Outlook with CVSS 6.5.
- Microsoft rates exploitation more likely for CVE-2026-113862, CVE-2026-118146, CVE-2026-118148, CVE-2026-118207 and CVE-2026-119952.
- CVE-2026-112967 in Windows Xbox Live Networking Service and CVE-2026-114160 in Azure Managed Grafana are scored 9.8.
- Outlook, Word and Office remote code execution bugs in the less-likely group are mostly scored 8.8.
- The Talos excerpt does not list fixed builds or Snort rule details.
Impact: Outlook UI spoofing; remote code execution and privilege escalation elsewhere
| Product | Affected |
|---|---|
| Microsoft Office Outlook | — |
| Microsoft Windows Network Address Translation (NAT) | — |
| Microsoft Active Directory Domain Services | — |
| Microsoft Exchange Server | — |
| Microsoft Windows Schannel | — |
| Microsoft Windows Hyper-V | — |
| Microsoft Azure Managed Grafana | — |
- 1.Install Microsoft’s November 2026 security updates for affected products.
- CVEs
- CVE-2026-124194CVE-2026-113862CVE-2026-118146CVE-2026-118148CVE-2026-118207CVE-2026-119952CVE-2026-109459CVE-2026-119967CVE-2026-110043CVE-2026-110068CVE-2026-111309CVE-2026-110047CVE-2026-110067CVE-2026-111285CVE-2026-124185CVE-2026-111289CVE-2026-120003CVE-2026-112967CVE-2026-113752CVE-2026-113753CVE-2026-113856CVE-2026-113860CVE-2026-113861CVE-2026-113865CVE-2026-119947CVE-2026-119960CVE-2026-113864CVE-2026-113825CVE-2026-113859CVE-2026-114160
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109459+1 related CVE | Heap buffer overflow in Windows Message Queuing Queue Manager | 8.1 | — | ||
CVE-2026-110043+2 related CVEs | Heap buffer overflow in Microsoft Outlook via network | 8.8 | — | ||
CVE-2026-110047+3 related CVEs | Use-after-free in Microsoft Office Word (user interaction) | 8.8 group max | — | ||
CVE-2026-124194+2 related CVEs | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 group max | — | KEVPoC | KEV |
| CVE-2026-112967 | Heap buffer overflow in Windows Xbox Live Networking Service | 9.8 | — | ||
| CVE-2026-113752 | Use-after-free in Windows Print Spooler over adjacent network | 7.5 | — | ||
| CVE-2026-113753 | Untrusted pointer dereference privilege escalation in Windows Hyper-V | 8.2 group max | — | ||
| CVE-2026-113825 | Race condition RCE in Windows SMB srvnet.sys | 7.5 | — | ||
| CVE-2026-113859 | Use-after-free in Windows TCP/IP over adjacent network | 7.5 | — | ||
| CVE-2026-113862 | Use-after-free RCE in Windows Network Address Translation | 8.1 | — | ||
| CVE-2026-114160 | Unauthenticated privilege elevation in Azure Managed Grafana | 9.8 | — | ||
CVE-2026-118146+1 related CVE | Incorrect authorization in Active Directory Domain Services | 8.8 group max | — | ||
| CVE-2026-118207 | Authenticated remote code execution in Exchange Server | 8.8 | — | ||
| CVE-2026-119952 | Timing discrepancy enabling network RCE in Windows Schannel | 8.1 | — |
From the original article
9 min read at blog.talosintelligence.com
Microsoft has released its monthly security update for November 2026, which includes 1328 vulnerabilities affecting a range of products, including 60 that Microsoft marked as "critical." Out of 60 "critical" vulnerabilities, 45 are remote code execution (RCE) vulnerabilities.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.