Patch Tuesday November 2026: One Zero-Day, 64 Critical Fixes Among 1,097 CVEs

tags: security, cybersecurity, windows, patchtuesday

Microsoft's November 2026 release fixes 1,097 vulnerabilities, 64 of them rated Critical. Of those, one is already exploited in the wild.

Patch Microsoft Outlook first: CVE-2026-124194 is being exploited in the wild and can expose authentication information when a user opens a crafted message file. Prioritize Mariner updates alongside it; both vulnerabilities are in CISA KEV and require customer patching.

Patch these first

• CVE-2026-124194 (Moderate, CVSS 6.5) — Microsoft Office Outlook: Spoofing — exploited in the wild, CISA KEV
• CVE-2026-123158 (Important, CVSS 8.1) — Mariner: see advisory — CISA KEV

CVE-2026-124194 lets an unauthenticated attacker send a specially crafted message file that, when opened in an affected Outlook version, can trigger a connection to an attacker-controlled network location without the usual external-content warning. That connection could disclose authentication information usable to impersonate the user. Exploitation requires user interaction and network connectivity. Deploy the Outlook patch now; exploitation is active and the vulnerability is in CISA KEV.

CVE-2026-123158 is also in CISA KEV. Patch affected Mariner systems as a priority; remediation requires a customer-applied update.

Also notable

• CVE-2026-118207 (Critical, CVSS 8.8) — Microsoft Exchange Server: Remote Code Execution
• CVE-2026-118146 (Critical, CVSS 8.8) — Active Directory Domain Services: Remote Code Execution
• CVE-2026-121663 (Important, CVSS 8.8) — Visual Studio Code: Security Feature Bypass
• CVE-2026-121662 (Important, CVSS 8.6) — Visual Studio Code: Remote Code Execution
• CVE-2026-113862 (Critical, CVSS 8.1) — Windows Network Address Translation (NAT): Remote Code Execution
• CVE-2026-119952 (Critical, CVSS 8.1) — Windows Schannel: Remote Code Execution
• CVE-2026-118148 (Critical, CVSS 7.5) — Active Directory Domain Services: Elevation of Privilege
• CVE-2026-119958 (Critical, CVSS 9.8) — Windows LDAP - Lightweight Directory Access Protocol: Remote Code Execution

By the numbers

• Elevation of Privilege: 536
• Remote Code Execution: 297
• Information Disclosure: 157
• Denial of Service: 46
• Security Feature Bypass: 27
• Spoofing: 22
• Tampering: 11
• Other: 1

Not counted above: 342 open-source CVEs (mostly Azure Linux packages) that Microsoft republished this month. Azure Linux admins should pick those up through the normal package updates.

Source: Microsoft Security Update Guide and the CISA KEV catalog.

Subscribe free → I write a curated cybersecurity news roundup, including this breakdown each Patch Tuesday. Get it in your inbox.