Microsoft November 2026 patches fix 1235 flaws, one exploited in Outlook
Original title: Microsoft Patch Tuesday, November 2026 Security Update Review
CISA added Outlook spoofing flaw CVE-2026-124194 to KEV and set a November 24, 2026 patch deadline.
Microsoft's November 2026 updates address 1235 vulnerabilities, including 63 critical and 1029 important, plus 142 in Edge. Qualys reports only CVE-2026-124194, an Outlook spoofing bug, as exploited in the wild. Opening a crafted message can make Outlook contact an attacker-controlled location without the usual warning and disclose authentication data. CISA urges patching before November 24, 2026. The release also fixes unauthenticated remote code execution bugs in Office, IIS, LDAP, and other Windows components.
- Sixty-three of the 1235 fixes are rated critical and 1029 important.
- Chromium-based Microsoft Edge accounts for 142 of the addressed vulnerabilities.
- CVE-2026-119961 is an unauthenticated race-condition remote code execution bug in IIS.
- CVE-2026-119990 is a missing-authentication elevation flaw in Azure OpenAI.
Impact: Outlook may disclose authentication data usable to impersonate the user
| Product | Affected |
|---|---|
| Microsoft Outlook | — |
| Microsoft Office | — |
| Microsoft Active Directory Domain Services | — |
| Microsoft Windows TPM | — |
| Microsoft Windows Internet Information Services | — |
| Microsoft Windows Remote Desktop Services | — |
| Microsoft Windows CredSSP | — |
| Microsoft Windows LDAP | — |
| Microsoft Azure OpenAI | — |
| Microsoft Defender | — |
- 1.Install the November 2026 Microsoft updates, prioritizing CVE-2026-124194 before November 24, 2026.
- CVEs
- CVE-2026-124194CVE-2026-120003CVE-2026-118148CVE-2026-119382CVE-2026-119961CVE-2026-119957CVE-2026-119962CVE-2026-119969CVE-2026-119966CVE-2026-119958CVE-2026-119952CVE-2026-119951CVE-2026-116928CVE-2026-110043CVE-2026-119990CVE-2026-120005CVE-2026-122194CVE-2026-111289CVE-2026-114160CVE-2026-110068CVE-2026-111309CVE-2026-118207
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-110043+2 related CVEs | Heap buffer overflow in Microsoft Outlook via network | 8.8 | — | ||
CVE-2026-124194+2 related CVEs | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 group max | — | KEVPoC | KEV |
| CVE-2026-114160 | Unauthenticated privilege elevation in Azure Managed Grafana | 9.8 | — | ||
| CVE-2026-116928 | Out-of-bounds write RCE in Windows Search Component | 9.8 | — | ||
| CVE-2026-118148 | Privilege escalation in Active Directory Domain Services | 7.5 | — | ||
| CVE-2026-118207 | Authenticated remote code execution in Exchange Server | 8.8 | — | ||
| CVE-2026-119382 | Heap buffer overflow in Windows TPM enables local privilege elevation | 7.8 | — | ||
| CVE-2026-119951 | Use-after-free in Windows Deployment Services | 8.1 | — | ||
| CVE-2026-119952 | Timing discrepancy enabling network RCE in Windows Schannel | 8.1 | — | ||
| CVE-2026-119957 | Local privilege escalation via double free in Windows RDS | 7.8 | — | ||
| CVE-2026-119958 | Unauthenticated remote code execution in Windows LDAP | 9.8 | — | ||
| CVE-2026-119961 | Race condition RCE in Windows Internet Information Services | 8.1 | — | ||
| CVE-2026-119962 | Double-free RCE in Windows Cred SSProvider Protocol | 8.1 | — | ||
| CVE-2026-119966 | Local privilege escalation via integer overflow in Windows Graphics Kernel | 7.5 | — | ||
| CVE-2026-119969 | Heap buffer overflow in Microsoft Graphic Fonts | 8.8 | — | ||
| CVE-2026-119990 | Missing authentication in Azure OpenAI enables privilege elevation | 9.8 | — | ||
| CVE-2026-120005 | Heap buffer overflow in Microsoft Office PowerPoint | 8.8 | — | ||
| CVE-2026-122194 | Null pointer dereference RCE in Microsoft Defender | 8.8 | — |
From the original article
11 min read at threatprotect.qualys.com
As the year approaches its final stretch, Microsoft’s November 2026 Patch Tuesday highlights the continued importance of proactive vulnerability management. This month’s security updates address vulnerabilities across the Microsoft ecosystem, reinforcing the need for organizations to promptly identify, prioritize, and remediate security risks.
By Diksha Ojha · threatprotect.qualys.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.