Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday - CyberScoop
Microsoft's November security update addresses 1,094 vulnerabilities across Windows, Office, Azure and other products, the second consecutive monthly release to exceed all previous years' totals.
The release specifically addresses 726 vulnerabilities in Windows and 174 in Office, with additional patches for SQL Server, Exchange Server, SharePoint Server, Azure and other Microsoft products. Despite the significant number of fixes, only one flaw is currently under active attack, and none were publicly known before the release.
Changing attacker methods
Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative, interpreted the lack of publicly exploited vulnerabilities as a sign of changing attacker methods rather than diminished exploitation.
Critical vulnerabilities
The exploited zero-day flaw, CVE-2026-124194, is an Outlook spoofing vulnerability that allows specially crafted message files to make Outlook connect to an attacker-controlled network location without warnings. It was added to CISA's Known Exploited Vulnerability (KEV) list shortly after Microsoft's release. The most severe fixes include CVE-2026-116928, a Windows Search vulnerability reachable through Exchange Server that Childs described as 'a zero-click code execution bug on a high-value target.'
A separate Windows LDAP flaw, also rated 9.8, could be 'quite destructive, especially on Domain Controllers,' according to Childs. The total number of vulnerabilities was actually less than last month's record-breaking 1,413 defects affecting Microsoft's enterprise products and services.
Related
