Microsoft Patch Tuesday Analysis – November 2026

Executive Summary

On Tuesday, November 10, 2026, Microsoft released its monthly security update, addressing 1,095 vulnerabilities across its product lineup.

By Severity Level:

• Important - 1,029;
• Critical - 64;
• Moderate - 2.

Exploited (Zero-Days) and Publicly Disclosed Vulnerabilities

Special attention should be directed to the following vulnerability. Applying this patch is of the highest priority:

• CVE-2026-124194 (CVSS 6.5; Moderate) - Microsoft Outlook Spoofing Vulnerability (Spoofing). A flaw in Microsoft Outlook caused by the absence of interface warnings when executing unsafe actions (CWE-356). An unauthenticated attacker can send a specially crafted message file to a victim and convince them to open it. Upon opening the file, the email client initiates an outbound network connection to an attacker-controlled resource, bypassing standard security warnings regarding external content downloads. This leads to the leakage of the user's NTLMv2 hash, allowing an attacker to impersonate the victim (the preview pane does not serve as an attack vector).

General Trends

The November 2026 Patch Tuesday continues the trend of addressing an immense volume of vulnerabilities in Microsoft products. Microsoft resolved 1,095 vulnerabilities. Despite a decrease compared to the record-breaking October release (1,417 patches), the operational burden on IT operations and cybersecurity teams remains critical for the third consecutive month. Key trends for November:

• Active exploitation of a zero-day vulnerability in Outlook (CVE-2026-124194). Microsoft designated this issue as Moderate; however, active targeted attacks utilizing it have been detected in the wild. The vulnerability is leveraged in phishing campaigns to capture NTLMv2 hashes while evading built-in security prompt mechanisms. Because it operates silently without triggering user alerts, it presents a severe threat as an initial entry point into corporate environments.
• Critical threats in cloud environments and CI/CD (CVSS 10.0 and 9.9). Fundamental security flaws were addressed: an Elevation of Privilege in the Entra Device Registration service (maximum score of 10.0) and Remote Code Execution in Azure DevOps Server (9.9). Both vulnerabilities carry a direct risk of compromise to device directories and the software supply chain.
• Windows kernel and core network service vulnerabilities (CVSS 9.8). A package of RCE vulnerabilities requiring no user interaction was remediated. Components affected include LDAP, DHCP Server, Windows Search, and Microsoft SQL Server (as well as the Xbox Live Networking stack). Flaws of this nature traditionally present significant risks of automated lateral movement within the network perimeter.
• Massive patches across Office components. A significant portion of this release addresses RCE vulnerabilities in Word, Excel, PowerPoint, Access, and Visio. Combined with the active attack vector via Outlook, this demonstrates that payload delivery via documents remains a primary vector for threat actors.
• Security of AI Services. The remediation of a critical flaw in Azure OpenAI (CVE-2026-119990) indicates that generative AI infrastructure has become a regular target for reverse engineering and demands the same patch management rigor as legacy services.

Full Vulnerability List

The table below lists all vulnerabilities addressed this month.