Microsoft released its Patch Tuesday November 2026 updates on November 10, and once again the release is exceptionally large. The company lists 1,095 vulnerabilities in its own products in the Security Update Guide. According to Microsoft, exactly one of them is already being exploited: the Outlook flaw CVE-2026-124194, which lets attackers capture NTLMv2 hashes. The US agency CISA added it to its catalog of known exploited vulnerabilities on the same day. Beyond that, a series of critical flaws in Windows network services, Exchange and Active Directory deserve a place near the top of every admin’s list.
Patch Tuesday November 2026 by the numbers
How big this Patch Tuesday is depends on how you count. The machine-readable CVRF document Microsoft publishes for every release contains 1,362 CVE entries for November 2026 (as of November 11). That figure, however, includes vulnerabilities in third-party components Microsoft ships or documents – such as 165 Chromium flaws affecting Edge and 41 Linux entries. Counting only the entries for which Microsoft itself is the CVE Numbering Authority (CNA) gives 1,095. Other tallies, for example from security vendors, differ depending on their method.
For those 1,095 Microsoft-assigned flaws, our analysis of the MSRC data for the November release shows the following picture:
- Severity: 64 critical, 1,029 important, 2 moderate.
- Elevation of privilege: 535 flaws – by far the largest group.
- Remote code execution: 297.
- Information disclosure: 157.
- Denial of service: 46, security feature bypass: 27, spoofing: 22, tampering: 11.
- Publicly disclosed before the patch: none.
- Exploited: one (CVE-2026-124194).
- “Exploitation More Likely”: Microsoft rates 42 flaws as more likely to be exploited.
The sheer volume has almost become routine: by the same counting method, October’s Patch Tuesday was even larger, while September came in just under a thousand. In practice, what matters is therefore less the total than the question of which flaws are already under attack and which services are directly reachable from the network.
CVE-2026-124194: Outlook leaks NTLMv2 hashes
The only flaw Microsoft says has been exploited sits in Outlook. Microsoft rates CVE-2026-124194 as a spoofing vulnerability with “moderate” severity and a CVSS 3.1 score of 6.5. It maps the root cause to weakness class CWE-356: the user interface does not warn the user about an unsafe action.
According to Microsoft, an unauthenticated attacker can send a specially crafted message file and convince the victim to open it in an affected version of Outlook. Outlook then connects to an attacker-controlled network location without showing the usual external-content warning. In the process, the user’s NTLMv2 hash can leak, which the attacker can use to authenticate as that user. The Preview Pane is not an attack vector, Microsoft says – the file has to be opened.
Affected products according to the advisory:
- Microsoft 365 Apps for Enterprise (32-bit and 64-bit),
- Office LTSC 2021 (32-bit and 64-bit), fixed in build 16.0.14334.21048,
- Office LTSC 2024 (32-bit and 64-bit), fixed in build 16.0.17932.21140.
Microsoft gives no details on the observed attacks – neither on the attackers nor on the scale. The advisory’s acknowledgments credit two finders, one of them with the note “using Claude with Anthropic”. CISA added CVE-2026-124194 to the KEV catalog on November 10; US federal agencies must remediate it by November 24. Whether it is used in ransomware campaigns is unknown, according to CISA.
Why a “moderate” bug still deserves priority
The relatively low CVSS score is misleading. NTLM hashes are valuable to attackers: they can be relayed against other services or cracked offline. Similar Outlook and Windows flaws in which a file triggers a connection to a remote share have repeatedly been exploited in phishing campaigns in the past. Because the attack starts with a file sent to the victim, it lends itself to broad campaigns.
Besides the Office update, general hardening measures help against this class of attack: block outbound SMB (TCP 445) to the internet at the firewall, enforce SMB and LDAP signing, enable Extended Protection for Authentication for Exchange and AD CS, and push back NTLM wherever Kerberos is an option. These are standard recommendations rather than specific guidance from the advisory – but they limit the damage if a hash does leak.
Critical flaws in network services, Exchange and AD
No further attacks are known beyond the Outlook flaw. Several of the critical entries, however, affect services that are exposed in many corporate networks:
- CVE-2026-116928, Windows Search (CVSS 9.8, critical): According to Microsoft, an unauthenticated attacker can target the Windows Search component used by Exchange Server by sending an email with a crafted attachment. Because Exchange processes attachments automatically for indexing, the recipient does not need to open the message.
- CVE-2026-119958, Windows LDAP (CVSS 9.8, critical): An out-of-bounds write that lets an unauthenticated attacker run code in the context of the LDAP service via crafted LDAP calls. Microsoft considers exploitation “less likely”.
- CVE-2026-118207, Exchange Server (CVSS 8.8, critical): An authenticated attacker with low privileges can execute code on the server via a crafted request. Rated “exploitation more likely”.
- CVE-2026-118146, Active Directory Domain Services (CVSS 8.8, critical): Incorrect authorization, also exploitable with low privileges and rated “more likely”.
- CVE-2026-119952, Windows Schannel (CVSS 8.1, critical): Unauthenticated remote code execution via crafted packets; the high attack complexity requires specific protocol settings.
- CVE-2026-116945, SQL Server (CVSS 9.8, important): A heap overflow that can be exploited when an integration package connects to an attacker-controlled endpoint.
Two cloud entries also carry high CVSS scores: CVE-2026-109469 in Entra Device Registration (10.0) and CVE-2026-119990 in Azure OpenAI (9.8). Microsoft says both have already been fixed server-side and customers need to take no action. Microsoft has been publishing such cloud CVEs for transparency for some time.
What admins should do now
- Office/Outlook first: Bring Microsoft 365 Apps and Office LTSC 2021/2024 up to the November level. For Microsoft 365 Apps, check that the update channels have actually applied the fix.
- Exchange servers: Install Windows and Exchange updates promptly – CVE-2026-116928 and CVE-2026-118207 are two critical flaws that directly affect the mail server.
- Domain controllers and LDAP: CVE-2026-119958 and CVE-2026-118146 make domain controllers a candidate for the first patch wave.
- Don’t forget browsers: The same KEV batch of November 10 also includes Chromium flaw CVE-2026-125350 (use-after-free), which affects Chrome and Edge.
- Review NTLM hardening: Block outbound SMB and enforce signing – regardless of the current patch.
Our take
Patch Tuesday November 2026 follows a pattern that has solidified this year: very high Microsoft CVE counts, but only a handful of flaws actually attacked before the patch. That puts the headline number into perspective, but it does not make prioritization any easier. Anyone staging update rings by risk should move Outlook, Exchange and domain controllers to the front.
On November 10, CISA added five more vulnerabilities to the KEV catalog alongside the Outlook flaw, including the two Barracuda ESG flaws around CVE-2026-116606 we have already covered. A day earlier, the FreeSWITCH flaw CVE-2026-116779 and the SSHole flaw in OpenSSH 10.6p2 had landed on the list, among others. The week shows that the number of actively exploited flaws across all vendors says more about priorities than the size of any single Patch Tuesday.
