← gociux.comall Patch Tuesdays

Patch Tuesday · November 2026

Patch Tuesday November 2026: 1,093 Microsoft CVEs, 1 exploited, 63 critical

, Gociux · 10 Nov 2026 · generated from Microsoft's security update API · 3 min read

1,093CVEs fixed
1exploited
63critical
0publicly disclosed

Microsoft's November 2026 release (published 10 Nov 2026) fixes 1,093 Microsoft CVEs across Windows, Office, Azure and server products. 1 is already exploited in the wild, which makes it the first thing to deploy. 63 are rated critical and 42 are assessed as more likely to be exploited. CISA has already added 1 of them to its Known Exploited Vulnerabilities catalog.

Patch order: exploited first, then publicly disclosed, then critical remote code execution on internet-facing systems, then everything Microsoft marks "exploitation more likely". The list below is in that order. Use stack check for Microsoft CVEs CISA has confirmed exploited over time.

Patch first (9)

CVE-2026-124194EXPLOITEDCISA KEVCVSS 6.5

Microsoft Outlook Spoofing Vulnerability

Moderate · Spoofing · Microsoft Office Outlook

CVE-2026-118146CVSS 8.8

Windows Active Directory Domain Services Remote Code Execution Vulnerability

Critical · Remote Code Execution · Active Directory Domain Services

CVE-2026-118207CVSS 8.8

Microsoft Exchange Server Remote Code Execution Vulnerability

Critical · Remote Code Execution · Microsoft Exchange Server

CVE-2026-113862CVSS 8.1

Windows Network Address Translation (NAT) Remote Code Execution Vulnerability

Critical · Remote Code Execution · Windows Network Address Translation (NAT)

CVE-2026-119952CVSS 8.1

Windows Schannel Remote Code Execution Vulnerability

Critical · Remote Code Execution · Windows Schannel

CVE-2026-118148CVSS 7.5

Active Directory Domain Services Elevation of Privilege Vulnerability

Critical · Elevation of Privilege · Active Directory Domain Services

CVE-2026-112967CVSS 9.8

Windows Xbox Live Networking Service Remote Code Execution Vulnerability

Critical · Remote Code Execution · Windows Xbox Live Networking Service

CVE-2026-116928CVSS 9.8

Windows Search Remote Code Execution Vulnerability

Critical · Remote Code Execution · Microsoft Windows Search Component

CVE-2026-119958CVSS 9.8

Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability

Critical · Remote Code Execution · Windows LDAP - Lightweight Directory Access Protocol

By impact

ImpactCVEs
Elevation of Privilege535
Remote Code Execution296
Information Disclosure156
Denial of Service46
Security Feature Bypass27
Spoofing22
Tampering11

Most-patched components

ComponentCVEs
Microsoft Office Word65
Microsoft Office Excel64
SQL Server53
Windows Advanced Rasterization Platform37
Windows Installer36
Windows Graphics Kernel35
Windows Kernel28
Microsoft Office SharePoint27
Windows DNS22
Windows Print Spooler Components20

How this is made: built automatically from Microsoft's November 2026 release via the MSRC CVRF API. Counted: CVEs assigned by Microsoft and first published on release day; third-party CVEs Microsoft republishes (Chromium for Edge, Linux and Azure Linux packages, open-source libraries) and later re-releases are excluded, so totals can differ slightly from other trackers. Cross-checked against the CISA KEV catalog. Severity, impact and exploitation status are Microsoft's own assessments at release time and can change; always confirm in the Security Update Guide before scheduling changes.

← October 2026all Patch Tuesdays →

Patching on evidence, every month?

We wire Microsoft's monthly release, CISA KEV and EPSS into your vulnerability workflow, so the few updates that matter ship first, with deadlines an auditor accepts.

Get in touch →