---
title: November 2026 Patch Tuesday: about 1,090 Microsoft CVEs, one exploited Outlook zero-day, and Exchange, AD DS, Schannel and NAT bugs Microsoft rates 'Exploitation More Likely' | ctxsec
url: https://ctxsec.com/items/pt-2026-11
description: "Microsoft's November release is the second four-figure month in a row: Tenable counts 1,093 Microsoft CVEs (63 Critical), SecurityWeek 1,094, and BleepingComputer's 1,235 includes Chromium and other third-party CVEs. The only exploited bug is the Outlook NTLM-leak spoofing flaw CVE-2026-124194, and nothing is listed as publicly disclosed. After that, the bugs Microsoft itself rates 'Exploitation More Likely' are the ones to schedule first."
status: "official (MSRC November 2026 release, Nov 10, 2026); counts per Tenable and SecurityWeek; exploitability labels are Microsoft's"
published: 2026-11-10
---

> Microsoft's November release is the second four-figure month in a row: Tenable counts 1,093 Microsoft CVEs (63 Critical), SecurityWeek 1,094, and BleepingComputer's 1,235 includes Chromium and other third-party CVEs. The only exploited bug is the Outlook NTLM-leak spoofing flaw CVE-2026-124194, and nothing is listed as publicly disclosed. After that, the bugs Microsoft itself rates 'Exploitation More Likely' are the ones to schedule first.

[← Cybersecurity News](/news) · [markdown](/items/pt-2026-11.md)

official (MSRC November 2026 release, Nov 10, 2026); counts per Tenable and SecurityWeek; exploitability labels are Microsoft's

2026-11-10

### November 2026 Patch Tuesday: about 1,090 Microsoft CVEs, one exploited Outlook zero-day, and Exchange, AD DS, Schannel and NAT bugs Microsoft rates 'Exploitation More Likely'

- **Exploited:** CVE-2026-124194 Outlook spoofing / NTLMv2 hash disclosure (Moderate, 6.5, on KEV).
- **Critical, Exploitation More Likely:** Exchange Server RCE CVE-2026-118207 (8.8, any low-privileged authenticated user, no interaction); Active Directory Domain Services RCE CVE-2026-118146 (8.8, low-privileged authenticated) and EoP to SYSTEM CVE-2026-118148 (7.5, race condition); Windows Schannel RCE CVE-2026-119952 (8.1, unauthenticated, needs specific configuration); Windows NAT RCE CVE-2026-113862 (8.1, unauthenticated packet, race condition).
- **Outlook Preview Pane RCEs again:** CVE-2026-110043, CVE-2026-110068 and CVE-2026-111309 (Critical, 8.8; Preview Pane is an attack vector for CVE-2026-110043 per Microsoft).
- **High scores under an Important label:** SharePoint Server EoP CVE-2026-120002 (9.9; a user with site read access and Secure Store membership can make SharePoint act on a connected business service with shared credentials) and SQL Server RCE CVE-2026-116945 (9.8; a malicious endpoint answering an integration package).
- **Cloud-only, no action:** Microsoft lists Critical service-side fixes such as Azure OpenAI EoP CVE-2026-119990 that it has already mitigated.
- Our [Microsoft label vs. reality](/dashboards/ms-label-reality) dashboard re-sorts the release by realistic attack class.

Sources: [MSRC: November 2026 security updates release notes](https://msrc.microsoft.com/update-guide/releaseNote/2026-Nov) · [Tenable: Microsoft's November 2026 Patch Tuesday addresses 1093 CVEs (Nov 10, 2026)](https://www.tenable.com/blog/microsoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194) · [SecurityWeek: Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft (Nov 10, 2026)](https://www.securityweek.com/exploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft/) · [Zero Day Initiative: The November 2026 Security Update Review (Nov 10, 2026)](https://www.thezdi.com/blog/2026/11/10/the-november-2026-security-update-review) · [MSRC: CVE-2026-118207 Exchange Server RCE](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118207) · [MSRC: CVE-2026-118146 AD DS RCE](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118146)