tags: security, cybersecurity, windows, patchtuesday

Microsoft's November 2026 release fixes 1,097 vulnerabilities, 64 of them rated Critical. Of those, one is already exploited in the wild.

Patch Microsoft Outlook first: CVE-2026-124194 is being exploited in the wild and can expose authentication information when a user opens a crafted message file. Prioritize Mariner updates alongside it; both vulnerabilities are in CISA KEV and require customer patching.

Patch these first

  • CVE-2026-124194 (Moderate, CVSS 6.5) — Microsoft Office Outlook: Spoofing — exploited in the wild, CISA KEV
  • CVE-2026-123158 (Important, CVSS 8.1) — Mariner: see advisory — CISA KEV

CVE-2026-124194 lets an unauthenticated attacker send a specially crafted message file that, when opened in an affected Outlook version, can trigger a connection to an attacker-controlled network location without the usual external-content warning. That connection could disclose authentication information usable to impersonate the user. Exploitation requires user interaction and network connectivity. Deploy the Outlook patch now; exploitation is active and the vulnerability is in CISA KEV.

CVE-2026-123158 is also in CISA KEV. Patch affected Mariner systems as a priority; remediation requires a customer-applied update.

Also notable

  • CVE-2026-118207 (Critical, CVSS 8.8) — Microsoft Exchange Server: Remote Code Execution
  • CVE-2026-118146 (Critical, CVSS 8.8) — Active Directory Domain Services: Remote Code Execution
  • CVE-2026-121663 (Important, CVSS 8.8) — Visual Studio Code: Security Feature Bypass
  • CVE-2026-121662 (Important, CVSS 8.6) — Visual Studio Code: Remote Code Execution
  • CVE-2026-113862 (Critical, CVSS 8.1) — Windows Network Address Translation (NAT): Remote Code Execution
  • CVE-2026-119952 (Critical, CVSS 8.1) — Windows Schannel: Remote Code Execution
  • CVE-2026-118148 (Critical, CVSS 7.5) — Active Directory Domain Services: Elevation of Privilege
  • CVE-2026-119958 (Critical, CVSS 9.8) — Windows LDAP - Lightweight Directory Access Protocol: Remote Code Execution

By the numbers

  • Elevation of Privilege: 536
  • Remote Code Execution: 297
  • Information Disclosure: 157
  • Denial of Service: 46
  • Security Feature Bypass: 27
  • Spoofing: 22
  • Tampering: 11
  • Other: 1

Not counted above: 342 open-source CVEs (mostly Azure Linux packages) that Microsoft republished this month. Azure Linux admins should pick those up through the normal package updates.

Source: Microsoft Security Update Guide and the CISA KEV catalog.

Subscribe free → I write a curated cybersecurity news roundup, including this breakdown each Patch Tuesday. Get it in your inbox.