Microsoft November 2026 Patch Tuesday fixes 1093 CVEs, one exploited
Original title: Microsoft’s November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194)
Outlook spoofing CVE-2026-124194, used as a zero-day, leaks NTLMv2 hashes when a crafted Office file is opened.
Microsoft’s November 2026 Patch Tuesday fixes 1093 CVEs across 287 products and components: 63 critical, 1029 important, and one moderate. Elevation of privilege is 48.9% of the set and remote code execution 27.1%. CVE-2026-124194, a moderate Outlook spoofing bug, was exploited as a zero-day to obtain NTLMv2 hashes from a crafted Office file. Several critical issues, including Active Directory, Exchange, and Schannel remote code execution, are rated Exploitation More Likely but not confirmed in attacks.
Unconfirmed: Only CVE-2026-124194 is confirmed exploited; other flaws are Microsoft exploitability assessments, and the Claude version used in discovery was not stated.
- Word and Excel lead the product counts with 65 and 64 CVEs.
- CVE-2026-124194 has CVSS 6.5; Microsoft credits a researcher who used Claude.
- SharePoint CVE-2026-120002 scores 9.9 but is rated Exploitation Less Likely.
- Active Directory CVE-2026-118146 and Exchange CVE-2026-118207 both score 8.8.
Impact: NTLMv2 hash theft; other flaws allow code execution or privilege gain
| Product | Affected |
|---|---|
| Microsoft Outlook | — |
| Microsoft Windows Active Directory Domain Services | — |
| Microsoft SharePoint Server | — |
| Microsoft Exchange Server | — |
| Microsoft Windows Schannel | — |
- 1.Apply Microsoft’s November 2026 security updates as soon as possible.
- 2.Scan for systems that still lack the November 2026 patches.
- CVEs
- CVE-2026-124194CVE-2026-118146CVE-2026-120002CVE-2026-118207CVE-2026-119952CVE-2026-121663CVE-2026-121662CVE-2026-113862CVE-2026-105501CVE-2026-105524CVE-2026-109473CVE-2026-112811CVE-2026-116714CVE-2026-119818CVE-2026-119853CVE-2026-119886CVE-2026-119892CVE-2026-119903CVE-2026-83563CVE-2026-88230
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-105501+2 related CVEs | Incorrect authorization in Windows Installer enables local privilege escalation | 7.8 | — | ||
| CVE-2026-105524 | Local privilege escalation via weak auth in Windows WMI | 7.8 | — | ||
| CVE-2026-109473 | Use-after-free local privilege escalation in Windows Kernel | 7.8 | — | ||
| CVE-2026-112811 | Local privilege escalation via stack overflow in Windows Print Spooler | 7.8 | — | ||
| CVE-2026-113862 | Use-after-free RCE in Windows Network Address Translation | 8.1 | — | ||
| CVE-2026-116714 | Local privilege escalation in Windows AppX Deployment Service | 7.8 | — | ||
| CVE-2026-118146 | Incorrect authorization in Active Directory Domain Services | 8.8 | — | ||
| CVE-2026-118207 | Authenticated remote code execution in Exchange Server | 8.8 | — | ||
| CVE-2026-119818 | Local privilege escalation in Windows Text Services Framework | 7.8 | — | ||
| CVE-2026-119853 | Untrusted search path LPE in Windows Remote Access API | 7.8 | — | ||
| CVE-2026-119886 | Local privilege escalation in Windows Telephony Service | 7.8 | — | ||
| CVE-2026-119952 | Timing discrepancy enabling network RCE in Windows Schannel | 8.1 | — | ||
| CVE-2026-120002 | Incorrect authorization privilege escalation in SharePoint | 9.9 | — | ||
CVE-2026-121663+1 related CVE | Security feature bypass in Visual Studio Code | 8.8 group max | — | ||
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEV | KEV |
| CVE-2026-83563 | Local privilege escalation via heap overflow in Winlogon | 7.8 | — | ||
| CVE-2026-88230 | Local privilege escalation via heap overflow in Windows LUAFV | 7.8 | — |
From the original article
8 min read at tenable.com
63Critical 1029Important 1Moderate 0Low Microsoft addresses 1093 CVEs in the eleventh Patch Tuesday of 2026. Microsoft patched 1093 CVEs in its November 2026 Patch Tuesday release, with 63 rated critical, 1029 rated as important, and one rated as moderate. This month’s update includes patches for 287 products and components.
By Research Special Operations · tenable.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.