Microsoft released its monthly security update on November 10: 1,093 new vulnerabilities fixed according to Tenable, a total consistent with Microsoft’s data, only one of which was already exploited by attackers, CVE-2026-124194, in Outlook. The volume remains staggering, even though it is down from October’s record. For IT teams at small and medium-sized businesses, the challenge is to triage: a few patches affect network-exposed services and deserve to be installed without delay.
The Outlook flaw: one file opened, one password exposed
CVE-2026-124194 is classified as a spoofing vulnerability, with a CVSS score of 6.5 and a severity rated only “moderate”. This modest rating should not reassure anyone: Microsoft’s advisory confirms that it was exploited before the patch was released. According to Security Affairs, the attacker sends a booby-trapped message file and must convince the target to open it. Outlook then contacts a server controlled by the attacker, without displaying the usual warning about external content.
This connection can leak the user’s NTLMv2 hash, a form derived from their password that the attacker can reuse to impersonate them, Tenable explains. Simply displaying the message in the preview pane is not enough to trigger the attack. According to CyberScoop, the US agency CISA quickly added it to its catalog of actively exploited vulnerabilities, on November 10. Tenable notes a detail that speaks to the times: the bulletin credits the discovery to a researcher who used Claude, Anthropic’s AI model.
The critical flaws to address first
Tenable counts 63 critical vulnerabilities. Nearly half of this month’s flaws involve elevation of privilege, and just over a quarter remote code execution. Several deserve immediate attention:
- CVE-2026-116928, in Windows Search accessible via Exchange Server: a zero-click code execution flaw rated 9.8. According to Security Affairs, all it takes is for the server to automatically index a malicious attachment. Dustin Childs, of the Zero Day Initiative, considers it more serious than the month’s nine Exchange patches, CyberScoop reports.
- CVE-2026-119958, in the Windows LDAP service, also rated 9.8: exploitable without authentication, it could cause considerable damage on domain controllers.
- CVE-2026-118146 (Active Directory Domain Services) and CVE-2026-118207 (Exchange Server), two code execution flaws rated 8.8 that Microsoft considers more likely to be exploited, according to Tenable.
- CVE-2026-119952, in Schannel, the Windows component that encrypts connections, exploitable without authentication despite high attack complexity.
The Zero Day Initiative also lists 30 flaws it considers wormable, able to spread from one machine to another without human intervention, compared with 59 the previous month, Security Affairs reports. They affect in particular Message Queuing, DNS and the Windows DHCP server.
Fewer exploited flaws, but no fewer attacks
October holds the record, with 1,413 vulnerabilities fixed, CyberScoop notes; November comes just behind. Counts also vary from one source to another. The number of flaws exploited before a patch, however, is falling. Dustin Childs refuses to see this as a lull: in his view, it does not mean exploitation is declining in the wild. He offers an explanation: AI is currently more effective at dissecting a published patch than at discovering and exploiting a flaw on its own in closed-source software. In other words, the time between the release of a patch and its exploitation could shrink.
What to do in practice
For a small organisation, the priority is exposed servers: Exchange, domain controllers, DNS and DHCP servers. On workstations, updating Office and Outlook removes the already exploited flaw. It is also worth reminding employees to be wary of message files received without context, even from a known sender. Finally, an inventory of unpatched machines, updated every month, remains the best protection against a volume of patches that has become impossible to follow line by line.
Frequently asked questions
How many vulnerabilities does the November 2026 Patch Tuesday fix?
Tenable counts 1,093, CyberScoop 1,094; totals vary depending on counting methods. Only one flaw, CVE-2026-124194 in Outlook, was exploited before it was fixed.
Is the Outlook flaw triggered simply by receiving an email?
No. The user must open the booby-trapped file. The preview pane is not an attack vector, according to Microsoft’s advisory as reported by Security Affairs.
Which patches should be installed first?
Those for Outlook and Office for the exploited flaw, then those for network services: Exchange, LDAP and Active Directory, DNS, DHCP and Schannel, which concentrate the remotely exploitable critical flaws.
Sources
- Microsoft's November 2026 Patch Tuesday Addresses 1,093 CVEs (CVE-2026-124194) — Tenable, 2026-11-10
- Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday — CyberScoop, 2026-11-10
- Microsoft November Patch Tuesday: one exploited Outlook bug and 30 wormable flaws — Security Affairs, 2026-11-11
- CVE-2026-124194 — Microsoft Outlook Spoofing Vulnerability — Microsoft Security Response Center, 2026-11-10
- Known Exploited Vulnerabilities Catalog — CISA, 2026-11-10