November 2026 Patch Tuesday: 1,252 CVEs Include One Zero-Day and 68 Critical Vulnerabilities
Microsoft addressed 1,252 vulnerabilities in its November 2026 security update release, including one exploited zero-day vulnerability and 68 Critical vulnerabilities.
This month's leading risk types by exploitation technique are elevation of privilege with 533 patches (43%), remote code execution (RCE) with 296 patches (24%), and information disclosure with 156 patches (12%). Windows received the most patches this month with 745, followed by ESU with 658, and Microsoft Office with 201.
Outlook Zero-Day Exploited
Preview-pane-triggered exploitation remains a dominant attack surface pattern for the third consecutive month, with eight Critical RCE vulnerabilities across Microsoft Office applications including Outlook and Word. CVE-2026-110043 and CVE-2026-110068 in Outlook exemplify the risk: Merely selecting a malicious message in the Reading Pane or previewing an attachment in File Explorer triggers code execution without any click or macro prompt.
CVE-2026-124194 is a Moderate spoofing vulnerability in Microsoft Outlook with a CVSS score of 6.5, and Microsoft confirms it is being exploited in the wild. The flaw stems from the product UI failing to warn users of unsafe actions.
Identity Platform Risks
Identity platform components face elevated risk this month with Critical flaws in both Lightweight Directory Access Protocol (LDAP) and Active Directory Domain Services (AD DS). CVE-2026-119958 enables RCE against LDAP, while CVE-2026-118146 and CVE-2026-118148 target AD DS with RCE and elevation-of-privilege attack paths, respectively.
Hyper-V and Legacy Services
Windows Hyper-V sees an unusually high concentration of privilege escalation vulnerabilities this month, with eight CVEs spanning multiple flaw classes. Legacy network services including Server Message Block (SMB) and Print Spooler continue to draw Critical-severity RCE findings, reinforcing the persistent risk these widely deployed components carry.
The unauthenticated network-reachable RCE cluster spans 14 CVEs this month, with Windows Message Queuing (MSMQ) vulnerabilities representing exposure on any system with MSMQ enabled.
Related
