Canada says Microsoft November rollup includes exploited CVE-2026-124194
Original title: Microsoft security advisory – November 2026 monthly rollup (AV26-1142)
The Cyber Centre lists dozens of Microsoft products as affected and urges administrators to apply updates as they become available.
The Canadian Centre for Cyber Security republished Microsoft's November 10, 2026 monthly rollup as AV26-1142. Microsoft is affected by vulnerabilities across Windows, Windows Server, .NET, Office, Azure, SQL Server, Visual Studio and many other products. Microsoft indicates that CVE-2026-124194 has been exploited. The centre urges users and administrators to review the linked updates and apply necessary patches as they become available.
Unconfirmed: The notice does not describe CVE-2026-124194's impact, severity or fixed versions.
- Advisory serial number is AV26-1142, dated November 10, 2026.
- Microsoft indicates CVE-2026-124194 has been exploited.
- Named products include Windows 10 and 11, Windows Server 2012 through 2025, and .NET 8.0 through 11.0.
- No impact, severity or fixed versions are stated in the Canadian notice.
Impact: Not stated; Microsoft says CVE-2026-124194 has been exploited.
| Product | Affected |
|---|---|
| Microsoft Windows 10 | — |
| Microsoft Windows 11 | — |
| Microsoft Windows Server | 2012 through 2025, including Server Core |
| Microsoft .NET | 8.0, 9.0, 10.0 and 11.0 |
| Microsoft 365 Apps | — |
| Microsoft Exchange Server Subscription Edition RTM | — |
| Microsoft SQL Server | 2017, 2019, 2022 and 2025 |
| Microsoft SharePoint Server Subscription Edition | — |
- 1.Review Microsoft's November 2026 Security Updates and apply necessary updates as they become available.
- CVEs
- CVE-2026-124194
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | 2% | KEVPoC | KEV |
From the original article
2 min read at cyber.gc.ca
Serial number: AV26-1142 Date: November 10, 2026 As of November 10, 2026, Microsoft is affected by vulnerabilities in the following products: . NET 10. 0 .
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.