Microsoft’s November Patch Tuesday Fixes 1,093 Vulnerabilities, Including Outlook Zero-Day
Summary
Microsoft’s November updates fix 1,093 vulnerabilities, including 63 critical flaws and an Outlook spoofing bug Microsoft says is actively exploited. The article also covers security updates from Apple, Google, Mozilla and Adobe.
Key points
- Microsoft’s November release fixes 1,093 vulnerabilities, including 63 rated critical; 535 allow privilege escalation.
- Microsoft says CVE-2026-124194, a spoofing flaw affecting Outlook, is being actively exploited.
- Apple released updates for iOS/iPadOS, macOS, watchOS and visionOS, including fixes for iMessage group-chat flaws.
- Chrome 157.0.8103.50 fixes nine vulnerabilities, including CVE-2026-125350, described as Chrome’s sixth zero-day of the year.
- Firefox 160 fixes almost 100 CVEs; Adobe released patches for at least 110 vulnerabilities and said it had no evidence of active exploitation.
- The article advises keeping devices updated, planning upgrades for unsupported hardware and backing up important data before applying operating-system updates.
Article Details
- Event Type
- Microsoft Patch Tuesday and other vendors’ security update releases
- Impact
- Microsoft released fixes for 1,093 vulnerabilities, including 63 critical flaws; 535 could allow privilege escalation, and nearly half of the critical flaws were remote code execution vulnerabilities. Microsoft reported active exploitation of the Outlook spoofing vulnerability CVE-2026-124194. Updates from Apple, Google, Mozilla, and Adobe also addressed vulnerabilities, including Chrome zero-day CVE-2026-125350.
CVE
CVE-2026-124194Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Office LTSC 2021; +1 moreAccording to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook.CVE-2026-125350Vendor / Product unavailableGoogle this week released Chrome version 157.0.8103.50, which resolves nine security holes, including CVE-2026-125350, the sixth zero-day vulnerability this year for Chrome (this bug also is being patched in
People
Chris GoettlIvanti vice president of product management who discussed patching, exposure management, and the number of exploited vulnerabilities added to CISA’s KEV list.Lee NeelySANS Institute instructor who commented on Apple’s security updates, including the backport to iOS 18 and the need to update devices.
Vendors
AdobeThis month’s Patch Tuesday addresses 63 critical flaws — including a zero-day in Microsoft Outlook — and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla.AppleThis month’s Patch Tuesday addresses 63 critical flaws — including a zero-day in Microsoft Outlook — and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla.GoogleThis month’s Patch Tuesday addresses 63 critical flaws — including a zero-day in Microsoft Outlook — and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla.MicrosoftMicrosoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software.MozillaThis month’s Patch Tuesday addresses 63 critical flaws — including a zero-day in Microsoft Outlook — and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla.
Products
Chromiumthe sixth zero-day vulnerability this year for Chrome (this bug also is being patched in Chromium-based browsers like Edge).Edgevulnerability this year for Chrome (this bug also is being patched in Chromium-based browsers like Edge).Google ChromeGoogle this week released Chrome version 157.0.8103.50, which resolves nine security holes, including CVE-2026-125350, the sixth zero-day vulnerability this year for Chrome (this bug also is being patched iniOSApple on Monday released out-of-cycle security updates to fix at least nine vulnerabilities in iOS/iPadOS, macOS, watchOS and visionOS.iPadOSApple on Monday released out-of-cycle security updates to fix at least nine vulnerabilities in iOS/iPadOS, macOS, watchOS and visionOS.macOSApple on Monday released out-of-cycle security updates to fix at least nine vulnerabilities in iOS/iPadOS, macOS, watchOS and visionOS.Microsoft 365 Apps for EnterpriseThe advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.Microsoft OfficeThe advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.Microsoft OutlookThis month’s Patch Tuesday addresses 63 critical flaws — including a zero-day in Microsoft Outlook — and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla.Microsoft WindowsMicrosoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software.Mozilla FirefoxA new version of Mozilla Firefox out today (Firefox 160) resolves almost 100 CVEs, about half of them high severity.visionOSApple on Monday released out-of-cycle security updates to fix at least nine vulnerabilities in iOS/iPadOS, macOS, watchOS and visionOS.watchOSApple on Monday released out-of-cycle security updates to fix at least nine vulnerabilities in iOS/iPadOS, macOS, watchOS and visionOS.