Microsoft’s November Patch Tuesday Addresses 1,093 Vulnerabilities, Including an Actively Exploited Zero-Day
Summary
Microsoft addressed 1,093 vulnerabilities, including 63 critical flaws and an actively exploited Outlook spoofing zero-day (CVE-2026-124194). The roundup highlights priority Exchange, SharePoint, Outlook, Windows Search and LDAP flaws and urges prompt patching.
Key points
- Microsoft addressed 1,093 security vulnerabilities; 63 were rated critical, and CVE-2026-124194 was confirmed under active exploitation.
- The Outlook spoofing flaw could expose an NTLMv2 hash if a target opens a malicious Office file, potentially enabling credential relay or cracking.
- Exchange Server CVE-2026-118207 allows an authenticated low-privilege attacker to run code; SharePoint Server CVE-2026-120002 allows privilege escalation.
- Outlook CVE-2026-110043 is a heap-based buffer overflow triggered when a target selects a weaponized email for display in the Preview Pane.
- Windows Search CVE-2026-116928 can enable unauthenticated, zero-click code execution when Exchange automatically indexes a crafted email attachment.
- CVE-2026-119958 affects Windows LDAP and could let an unauthenticated attacker trigger an out-of-bounds write by sending crafted LDAP calls.
- Experts advise prioritizing internet-facing and actively exploited systems, and testing and deploying patches quickly for wormable flaws in network-facing services.
Article Details
- Event Type
- Microsoft November Patch Tuesday security update addressing 1,093 vulnerabilities, including critical flaws and one zero-day.
- Impact
- Microsoft confirmed that CVE-2026-124194 is under active exploitation. The Outlook spoofing vulnerability may expose a victim’s NTLMv2 hash, which an attacker may be able to relay or crack. Other highlighted flaws could allow remote code execution in Exchange Server, Outlook, and Windows Search, or privilege escalation in SharePoint Server. The article recommends prioritizing exposed and exploited systems and deploying the relevant updates.
CVE
CVE-2026-110043Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Office LTSC 2021; +1 moreAnother critical RCE to watch out for, according to Automox, is CVE-2026-110043 (CVSS 8.8/10), a one-click heap-based buffer overflow in Outlook that uses the Preview Pane as an attack vector. A target must select aCVE-2026-116928Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +14 moreDustin Childs, head of threat awareness at the Zero-Day Initiative (ZDI), also identified a Windows Search RCE (CVE-2026-116928, CVSS 9.8) as needing immediate attention.CVE-2026-118207Microsoft · Microsoft Exchange Server Subscription Edition RTMThe first, in Exchange Server (CVE-2026-118207, CVSS 8.8), "belongs in this week's emergency window for every Exchange Server Subscription Edition server you run," Automox researchers warned in their monthly PatchCVE-2026-119958Vendor / Product unavailableAnd finally, Childs pointed to CVE-2026-119958, an RCE bug in Windows Lightweight Directory Access Protocol (LDAP).CVE-2026-120002Microsoft · Microsoft SharePoint Server Subscription EditionMeanwhile, an important-rated flaw (CVE-2026-120002, CVSS 9.9) in SharePoint Server is an elevation of privilege vulnerability that needs quick addressing, according to Automox.CVE-2026-124194Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Office LTSC 2021; +1 moretoday addressed 1,093 security vulnerabilities, with 63 rated critical, and one zero-day in the mix (CVE-2026-124194, CVSS 6.5) that Microsoft confirmed is under active exploit.
People
Dustin ChildsHead of threat awareness at the Zero-Day Initiative; identified Windows Search and LDAP vulnerabilities as priorities and recommended promptly patching wormable bugs.Jake KnottHead of threat intelligence at Watchtowr; commented on security teams’ vulnerability-triage priorities during the Patch Tuesday release.Satnam NarangSenior staff research engineer at Tenable; described how CVE-2026-124194 could expose an NTLMv2 hash and how an attacker might use it.Tyler RegulyAssociate director of security R&D at Fortra; commented on prioritizing updates amid the large Patch Tuesday release.
Vendors
Products
Microsoft Exchange ServerThe first, in Exchange Server (CVE-2026-118207, CVSS 8.8), "belongs in this week's emergency window for every Exchange Server Subscription Edition server you run," Automox researchers warned in their monthly PatchOffice"To exploit it, an attacker sends a target a malicious Office file and convinces them to open it," explained Satnam Narang, senior staff research engineer at Tenable, in his monthly Patch Tuesday commentary. "If theOutlookand not just because attackers are already targeting it. It's a spoofing vulnerability in Outlook that may not allow code execution, hence its moderate severity rating, but could allow the disclosure ofSharePoint ServerMeanwhile, an important-rated flaw (CVE-2026-120002, CVSS 9.9) in SharePoint Server is an elevation of privilege vulnerability that needs quick addressing, according to Automox.Windows Lightweight Directory Access Protocol (LDAP)And finally, Childs pointed to CVE-2026-119958, an RCE bug in Windows Lightweight Directory Access Protocol (LDAP).Windows SearchDustin Childs, head of threat awareness at the Zero-Day Initiative (ZDI), also identified a Windows Search RCE (CVE-2026-116928, CVSS 9.8) as needing immediate attention.