November 2026 Patch Tuesday: about 1,090 Microsoft CVEs, one exploited Outlook zero-day, and Exchange, AD DS, Schannel and NAT bugs Microsoft rates 'Exploitation More Likely'
- Exploited: CVE-2026-124194 Outlook spoofing / NTLMv2 hash disclosure (Moderate, 6.5, on KEV).
- Critical, Exploitation More Likely: Exchange Server RCE CVE-2026-118207 (8.8, any low-privileged authenticated user, no interaction); Active Directory Domain Services RCE CVE-2026-118146 (8.8, low-privileged authenticated) and EoP to SYSTEM CVE-2026-118148 (7.5, race condition); Windows Schannel RCE CVE-2026-119952 (8.1, unauthenticated, needs specific configuration); Windows NAT RCE CVE-2026-113862 (8.1, unauthenticated packet, race condition).
- Outlook Preview Pane RCEs again: CVE-2026-110043, CVE-2026-110068 and CVE-2026-111309 (Critical, 8.8; Preview Pane is an attack vector for CVE-2026-110043 per Microsoft).
- High scores under an Important label: SharePoint Server EoP CVE-2026-120002 (9.9; a user with site read access and Secure Store membership can make SharePoint act on a connected business service with shared credentials) and SQL Server RCE CVE-2026-116945 (9.8; a malicious endpoint answering an integration package).
- Cloud-only, no action: Microsoft lists Critical service-side fixes such as Azure OpenAI EoP CVE-2026-119990 that it has already mitigated.
- Our Microsoft label vs. reality dashboard re-sorts the release by realistic attack class.
Sources: MSRC: November 2026 security updates release notes · Tenable: Microsoft's November 2026 Patch Tuesday addresses 1093 CVEs (Nov 10, 2026) · SecurityWeek: Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft (Nov 10, 2026) · Zero Day Initiative: The November 2026 Security Update Review (Nov 10, 2026) · MSRC: CVE-2026-118207 Exchange Server RCE · MSRC: CVE-2026-118146 AD DS RCE