Microsoft's November 2026 Patch Tuesday shipped today with 1,094 CVEs, the second straight month above every prior annual record after October's ~1,474 drop. Yet only one flaw, the CVE-2026-124194 Outlook spoofing bug, was actually being exploited in the wild, and none were publicly disclosed before the patch. Despite the low active-exploit count, the release is packed with wormable Critical RCEs like the zero-click Exchange path CVE-2026-116928 and an LDAP flaw rated 9.8. Admins should patch identity infrastructure first, treat the 6.5-rated Outlook bug as critical anyway, and note that Windows 11 23H2 Enterprise and Education reached end of updates that same day.

Microsoft's November Patch Tuesday hits a record 1,094 CVEs, though almost nobody is exploiting them

Microsoft shipped its scheduled November security update today and knocked another monthly record out of the park. The release covers 1,094 Microsoft CVEs spanning Windows, Office, SQL Server, Azure, and Exchange. It's the second straight month the company has blown past every prior Patch Tuesday. October's ~1,474-CVE drop was already being dubbed Microsoft's biggest update ever by Qualys.

Here's where it gets strange. Of all 1,094 flaws, exactly one was flagged as actively exploited in the wild, and none had been publicly disclosed before the patch shipped. You've got record-breaking volume with almost nothing weaponized on top of it. Analysts say that mismatch might be pointing at something bigger about how attackers are changing their playbooks.

What actually matters this month

The only flaw Microsoft marked "Exploitation Detected" is CVE-2026-124194, a Microsoft Outlook spoofing bug rated a moderate 6.5 on the CVSS scale. Don't let that score send you scrolling past it. Zero Day Initiative's Dustin Childs warns the impact cuts deeper than the "spoofing" label suggests.

An attacker sends a specially crafted message file and talks a victim into opening it. Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, handing over the user's NTLMv2 hash. Once harvested, that hash can be replayed to authenticate as the victim and open a door to lateral movement.

Keep in mind that the Preview Pane is not an attack vector here. Physical or click interaction with the message file is still required.

The affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and Outlook 2016. That's a meaningful slice of the enterprise base.

The actively exploited bug is really just one entry on a much longer queue. Microsoft's release is laced with Critical-severity remote code execution flaws, many reachable over the network with no authentication and no user interaction. Zero Day Initiative counted 30 "wormable" CVEs this month, down from 59 in October but still a serious pile.

A few worth landing at the top of your list. CVE-2026-116928 is a zero-click RCE over Windows Search through Exchange, rated 9.8. An unauthenticated attacker just sends an email with a crafted attachment, and the server indexes it automatically. The recipient never even opens it.

CVE-2026-119958 is an out-of-bounds write in Windows LDAP, also 9.8, running in the LDAP service context. That makes it especially destructive on a Domain Controller.

Then there's CVE-2026-119952, a Schannel RCE rated 8.1 but tagged "Exploitation More Likely." Microsoft reserves that designation for flaws it considers probable targets, so treat this one as if it's already being weaponized. Odd duck in the batch is CVE-2026-119990 over Azure OpenAI, marked 9.8 with "Customer Action Required" yet listing no mitigations or steps. Ping Microsoft before you assume that one is actually covered.

The wormable set runs deep across infrastructure-critical services: Message Queuing, DNS, DHCP, Color Management, DirectMusic, Xbox, LDAP, Schannel, CredSSP, Deployment Services, and IIS. Network-facing services like DNS, DHCP, LDAP, and Exchange should be patched first.

November's 1,094 only makes sense against the recent arc. Patch Tuesdays used to land around 50 CVEs. Now the hundreds are the new normal, and October's ~1,474 took the crown from September's ~975.

Childs put it plainly. November is "less than the 1,400 or so released last month," he noted, but stresses, "That's two months in a row that have exceeded all previous years from Microsoft."

The headline figure invites a healthy dose of skepticism, because different trackers report wildly different totals. Some patch managers count only genuine Microsoft product CVEs, dropping Azure Linux and republished Chromium fixes from the tally. Add those back and the published count climbs well past 1,094. Microsoft itself admits the number is "a bit confusing." For your remediation queue, what matters is that hundreds of genuine flaws need action, not the exact digit.

That number game sits next to a real problem that's been simmering. Earlier this month, an out-of-bounds RCE in Microsoft Paint (CVE-2026-83844) showed a wrinkle: because Paint ships as a decoupled AppX store app, its fix (build 11.2609.401.0) came only through the Microsoft Store, not Windows Update or WSUS. Enterprises leaning on traditional OS-patching baselines were left open until the Store build caught up weeks after initial disclosure. It's a textbook example of the "servicing divide" between OS updates and store apps. Not great. Microsoft later re-scored the flaw to 7.0 after clarifying it needs local access plus user interaction.

Adobe wasn't idle, shipping nine bulletins covering 110 CVEs, topped by APSB26-191 for Adobe Connect (24 CVEs, a top CVSS of 10.0). Microsoft Edge keeps tracking Chromium's cadence rather than Patch Tuesday, republishing fixes under its own CVE numbers.

Before you roll it out

Microsoft published several known issues tied to specific KB articles. SQL Server admins should note 5129299 for 2025 CU10 and 5129300 for 2022 CU27. Windows Server 2025 falls under 5131080, while older Windows 10 builds are covered by 5131085 and 5131291.

Two deployment habits still pay off. Install the Servicing Stack Update first, keeping a current list in advisory ADV990001 before you drop in the cumulative update. And remember that Windows 10 and 11 updates are cumulative, so the November release already contains every prior security fix plus non-security changes.

There's a hard clock ticking too. Windows 11 version 23H2, in Enterprise and Education editions, reaches end of updates today, November 10. This is the last security update those editions will get. If you're still running them, plan a migration or buy Extended Security Updates now.

A final set of takeaways that sound obvious but keep getting ignored. Patch your identity infrastructure first, since AD DS, LDAP, CredSSP, and Schannel flaws together form a decent lateral-movement toolkit. Treat that 6.5 Outlook spoofing bug with the same urgency as a Critical RCE. And don't get lulled by the dropping zero-day count: fewer exploits in the wild reflects smarter AI-driven patch reversal, not quieter attackers.

For the authoritative numbers, head here to the Microsoft Security Update Guide.