Microsoft Patch Tuesday November 2026

The November Patch Tuesday update addresses 1235 vulnerabilities, including 1 zero-day vulnerability in Outlook.

The following vulnerabilities were addressed through the update that threat actors exploited to orchestrate attacks:

Through this blog, we will understand the vulnerabilities that require immediate attention and what organizations need to prioritize while remediating across their Microsoft environments.

Products covered

The November security release covers multiple Microsoft products and components, including:

• Windows client and server operating systems
• Microsoft Office, including Word, Excel, and Outlook
• Microsoft SQL Server
• Microsoft SharePoint Server
• Microsoft Exchange Server
• Microsoft .NET
• Microsoft Dynamics 365
• Microsoft Azure
• Microsoft Visual Studio
• Windows Kernel and Windows Graphics Kernel
• Windows Installer
• Windows DNS
• Microsoft Edge (Chromium-based)
• Other Microsoft application and platform components

Microsoft has also released security updates for Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2, as well as Windows Server 2025, 2022, 2019, and 2016.

1 zero-day vulnerability addressed

Microsoft’s November Patch Tuesday has addressed 1 zero-day vulnerability in Outlook.

CVE-2026-124194 – Microsoft Outlook – Spoofing vulnerability

Severity – CVSS 6.5 (Moderate)

Status – Actively exploited

Microsoft has fixed one actively exploited spoofing vulnerability, tracked as CVE-2026-124194, that allows unauthenticated attackers to send a specially crafted message file and convince a user to open it. By successfully exploiting the flaw, an attacker can:

• Bypass Outlook’s usual external content security warning.
• Trigger an outbound connection to an attacker-controlled network location.
• Capture the victim’s NTLMv2 authentication hash.
• Attempt to crack the captured hash offline to recover the user’s credentials.
• Use the recovered credentials to impersonate the affected user and potentially gain unauthorized access to corporate resources.

Recommendations

• Prioritize the updating of affected Outlook installations.
• Monitor suspicious outbound network connections.
• Investigate unusual NTLM authentication activity.

Other vulnerabilities addressed

CVE-2026-116928 – Windows Search – Remote Code Execution

Severity – CVSS 9.8 (Critical)

This vulnerability affects the Windows Search feature which allows an unauthenticated attacker to execute arbitrary code through a specially crafted email attachment.

An attacker could exploit the flaw to:

• Execute arbitrary code on a vulnerable system,
• Exploit how email attachments are processed.
• Gain unauthorized access to affected systems.
• Cause a compromise of the integrity and availability of compromised systems.

Recommendations

• Prioritize patching the affected Exchange servers.
• Ensure security updates are applied to systems running the Windows Search component.
• Monitor for suspicious attachment processing activity and unexpected code execution.

CVE-2026-119952 – Windows Schannel – Remote Code Execution

Severity – CVSS 8.1 (Critical)

Microsoft has also fixed a remote code execution vulnerability in Windows Schannel that could allow an unauthenticated attacker to execute arbitrary code through specially crafted network packets on vulnerable systems.

An attacker could exploit the flaw to:

• Execute arbitrary code on an affected system.
• Exploit the vulnerable Schannel network communication process.
• Compromise systems without requiring valid authentication.
• Disrupt the confidentiality, integrity, and availability of affected systems.

Recommendations

• Apply the security updates to affected systems.
• Monitor for unusual network traffic targeting Schannel services.
• Prioritize internet-facing systems.

CVE-2026-119958 – Windows LDAP – Remote Code Execution

Severity – CVSS – 9.8 (Critical)

A critical remote code execution vulnerability affecting Windows Lightweight Directory Access Protocol (LDAP) that could allow an attacker to execute arbitrary code on a vulnerable system, posing a significant risk to directory services infrastructure.

An attacker could exploit the flaw to:

• Execute arbitrary code on affected systems.
• Potentially compromise systems running vulnerable LDAP services.
• Gain unauthorized access to directory service infrastructure.
• Disrupt directory services and affect the availability/integrity of connected resources.

Recommendations

• Immediately patch the affected systems.
• Restrict LDAP access to trusted networks.
• Monitor for unusual LDAP requests and process execution.

CVE-2026-118207 – Microsoft Exchange Server – Remote Code Execution

Severity – CVSS 8.8 (Critical)

A remote code execution flaw in Microsoft Exchange Server was also fixed by Microsoft which could allow an authenticated attacker with low privileges to execute arbitrary code on an affected server.

An attacker could exploit the flaw to:

• Execute arbitrary code on a vulnerable Exchange Server.
• Exploit existing access to compromise the server.
• Gain unauthorized access to sensitive Exchange resources.
• Disrupt email services and affect the integrity/confidentiality, and availability of affected systems.

Recommendations

• Apply the Microsoft Exchange Server security update.
• Verify patch installation through Exchange Server Health Checker.
• Review access logs for suspicious activity and unexpected process execution.

SharkStriker’s Recommendations

• Identify all Microsoft products and systems deployed within your environment that are affected by the November 2026 security updates.
• Prioritize patching CVE-2026-124194 due to confirmed active exploitation and its inclusion in CISA’s KEV catalogue.
• Expedite remediation of critical RCE vulnerabilities, particularly those affecting Windows LDAP, Schannel, Windows Search, and Exchange Server.
• Apply the applicable November 2026 security updates to supported Windows, Office, Exchange, and other affected Microsoft products.
• Ensure SMB and LDAP signing protections are appropriately enforced to reduce the risk of NTLM relay attacks.
• Follow the organization’s change-management process when deploying security updates.
• Following remediation, confirm that affected systems have been successfully updated to the applicable patched versions.