Microsoft November patches list 1,094 CVEs; one Outlook flaw exploited
Original title: Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday
CISA added the exploited Outlook spoofing bug to KEV; a Windows Search flaw is called zero-click code execution.
Microsoft’s November update addresses about 1,090 flaws, formally listing 1,094 CVEs, including 726 in Windows and 174 in Office, plus smaller sets for SQL Server, Exchange, SharePoint, Azure and other products. Only CVE-2026-124194, an Outlook spoofing bug, is under active attack, and none were publicly known before release. A crafted message file makes Outlook connect to an attacker-controlled location without the usual external-content warning. TrendAI’s Dustin Childs also flagged CVE-2026-116928, a Windows Search bug reachable through Exchange, and a separate Windows LDAP flaw rated 9.8.
Unconfirmed: Childs’s claim that fewer exploited zero-days reflect AI reversing patches better than finding closed-source bugs is his interpretation.
- Last month’s release listed a record 1,413 defects.
- Exchange receives nine fixes this month.
- Childs called the Windows Search bug more severe than those Exchange fixes.
- He said the LDAP flaw could be destructive on Domain Controllers.
Impact: Outlook connects to an attacker-controlled network without warning
| Product | Affected |
|---|---|
| Microsoft Outlook | — |
| Microsoft Windows Search | — |
| Microsoft Windows LDAP | — |
- 1.Apply Microsoft’s November security updates, prioritizing CVE-2026-124194.
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-116928 | Out-of-bounds write RCE in Windows Search Component | 9.8 | — | ||
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEV | KEV |
From the original article
2 min read at cyberscoop.com
Microsoft’s November security update addresses roughly 1,090 vulnerabilities across Windows, Office, Azure and the company’s other product lines, the second consecutive monthly release to exceed the totals of all previous years. The release formally lists 1,094 CVEs, with Windows accounting for 726 and Office 174. A smaller number of patches went to SQL Server, Exchange […]
By Greg Otto · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.