Microsoft is publishing 1,092 own-product vulnerabilities on November 2026 Patch Tuesday, including 1,102 vulnerabilities in Windows. Until a few months ago, these volumes would have been unimaginable, but if anything, this month feels like a slight reprieve. The jury is still out on whether patching many more vulnerabilities will lead to better security outcomes; every code change to resolve a known vulnerability could easily introduce new hidden treasure for researchers or threat actors to unearth in the future. Despite the vast uptick in volume during 2026, there has been no accompanying increase in the number of vulnerabilities known to be exploited in the wild. Microsoft is aware of exploitation in the wild for just one of the vulnerabilities published today, with no known public disclosure at all this month.
Outlook: zero-day spoofing
Imagine coming home and checking your mailbox to find a postcard. You admire the non-specific image of a tropical beach at sunset, and flip it over to scan the handwriting on the back, which looks vaguely familiar. It’s addressed to you, but you can’t make out the signature, and the message is short and generic. Is that real handwriting, or has this been printed? Probably marketing material. You put the card in the recycling and, since life is busy, you move on and forget about it. Somehow, you remain entirely unaware that, immediately after reading the postcard, you took out your phone and sent high-resolution images of your front door key to a number you’ve never contacted before. Is this sketch just some rather questionable science fiction? Yes, hopefully, but what if that non-specific postcard was instead a malicious file in your Outlook inbox? Now we’re talking about CVE-2026-124194, an exploited-in-the-wild spoofing vulnerability. Merely opening a specially crafted malicious file causes Outlook to silently connect to an attacker-controlled location and leak the user’s NTLM v2 hash. All supported versions of classic Outlook receive patches. The relatively low CVSS v3.1 base score of 6.5 does not tell the full story here, since this vulnerability provides value for both commodity attackers working to harvest initial access at scale, and also more targeted campaigns by more sophisticated threat actors. The NTLM v2 hash can be relayed live to impersonate the user against another service, at least where those services do not implement adequate safeguards such as message signing for SMB or LDAP, as well as Extended Protection for Authentication for Exchange or Active Directory Certificate Services. Alternatively, the NTLM v2 hash can be cracked offline by a motivated attacker to retrieve the underlying credential. The Preview Pane is not a vector, which will help limit the real-world impact somewhat.
Windows Schannel: critical pre-auth RCE
A pre-authentication remote code execution (RCE) vulnerability in Windows will always attract attention. CVE-2026-119952 allows an attacker to execute code on a target system by sending specially crafted malicious packets. Since the vulnerable component is Schannel, which is Microsoft’s implementation of Transport Layer Security (TLS), attackers may not have to look very far to find vulnerable endpoints. The advisory provides some comfort by pointing out that specific conditions are required for exploitability, which reduces the likelihood of broad exploitation, but the advisory still assesses exploitation as more likely, so Microsoft presumably expects that the development of reliable exploit code is feasible. In many cases, there will be no need for an attacker to have an existing foothold on the same subnet. The execution context likely depends on the vulnerable service, which points to the evergreen need for least privilege architecture, but it also means that we cannot exclude the possibility of pre-auth RCE as SYSTEM in some cases.
Exchange/Windows Search: critical pre-auth RCE
Could someone take control of your Exchange server by sending a single email? In short: yes. Microsoft offers customers tight integration between various business-critical components. Exchange running on Windows is Microsoft on Microsoft, and the Windows Search component indexes email on behalf of Exchange. An attacker aiming to exploit CVE-2026-116928 relies on this helpful synergy to achieve pre-auth RCE on the server by sending a malicious attachment, which Exchange will process automatically. How’s that for low attack complexity? Although the advisory does not specify the context of execution, we should assume SYSTEM, since several of the services which might be involved do run with a high privilege level. Since the patches are for Windows OS rather than Exchange itself, there’s no need to worry about which version of Exchange you’re running, so long as you are running only Exchange Subscription Edition, since all previous versions of Exchange are now fully beyond end of support.
Microsoft lifecycle update
There are fewer Microsoft product lifecycle changes in November 2026 than last month. As of Nov 11, 2026, .NET 8 Long Term Servicing channel moves past its release end date, along with PowerShell 7.4 LTS, and the 23H2 versions of the Enterprise, Education, and IoT editions of Windows 11.
Summary charts
Summary tables
Vulnerabilities by Product Family
Apps vulnerabilities
Azure vulnerabilities
Developer Tools vulnerabilities
ESU vulnerabilities
Mariner vulnerabilities
Microsoft Dynamics vulnerabilities
Microsoft Office vulnerabilities
Open Source Software vulnerabilities
Other vulnerabilities
Server Software vulnerabilities
SQL Server vulnerabilities
System Center vulnerabilities
Windows vulnerabilities
Zero-Day Vulnerabilities: Known Exploited
| | Microsoft Outlook Spoofing Vulnerability | Exploitation Detected | No | 6.5 |
Zero-Day Vulnerabilities: Publicly Disclosed (No known exploitation)
None
Critical RCEs and EoPs
| CVE-2026-114146 | ASP.NET Core Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 9.0 | | CVE-2026-109467 | Azure DevOps Server Remote Code Execution Vulnerability | N/A | No | 9.9 | | CVE-2026-119990 | Azure OpenAI Elevation of Privilege Vulnerability | N/A | No | 9.8 | | CVE-2026-96067 | Microsoft Color Management Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-96078 | Microsoft Color Management Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-95882 | Microsoft DirectMusic Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-95901 | Microsoft DirectMusic Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-114162 | Microsoft Graph Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 9.1 | | CVE-2026-80095 | Microsoft Office SharePoint Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 9.0 | | CVE-2026-120002 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 9.9 | | CVE-2026-116945 | Microsoft SQL Server Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-96157 | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-120779 | Visual Studio Code Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.6 | | CVE-2026-88243 | Windows DHCP Server Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-88218 | Windows DNS Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-88234 | Windows iSCSI Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-85844 | Windows Kerberos Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-119958 | Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-116928 | Windows Search Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-95962 | Windows Virtual Filtering Platform (VFP) Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.0 | | CVE-2026-112967 | Windows Xbox Live Networking Service Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 |
Article tags
- Patch Tuesday
- Vulnerability Management
