Microsoft’s November 2026 Patch Tuesday release fixes 1,094 CVEs. Out of those, one is already being exploited: CVE-2026-124194, an Outlook spoofing bug that hands an attacker the user’s NTLMv2 hash when a crafted message file is opened. Saving grace that no other vulnerabilities are publicly disclosed. CISA has already added it to KEV, due 24 November, with no forensic triage. My advice – patch Outlook first, administrators’ machines within three days, and block outbound SMB today. In these series, I rank by the four BOD 26-04 risk variables (KEV status, exposure, automation, technical impact), not by CVSS, because 1,094 CVEs sorted by score bury the one that is being used. KEV values come from catalogVersion 2026.11.10, released 2026-11-10T19:03:29Z, the day Microsoft published. Last updated 2026-11-10.
Microsoft’s release note says 1,094 CVEs, but the CVRF carries 1,095 Microsoft-numbered entries. The odd one out is CVE-2026-122518, the only Microsoft-numbered Microsoft Edge (Chromium-based) entry in the file: an information disclosure bug (CWE-125, CVSS 6.5, network, no privileges, user interaction required) that Microsoft rates Moderate and Exploitation Less Likely, and that could potentially read small portions of heap memory. Its revision history is dated 4 November, six days before the release. My reading is that the note’s count leaves the Edge entry out; Microsoft does not say so. This post includes it, so the first table below totals 1,095, one more than Microsoft’s headline.
Which Microsoft CVEs are exploited or publicly disclosed in November 2026?
| CVE | Component | Type | CWE | CVSS | Exploitability | KEV | Due | Forensic triage | CPE |
|---|---|---|---|---|---|---|---|---|---|
| CVE-2026-124194 | Outlook (Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024) | Spoofing (NTLMv2 hash disclosure) | CWE-356 | 6.5 | Detected | Yes, added 2026-11-10 (catalogVersion 2026.11.10) | 2026-11-24 | No | cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:* (and 2 more) |
Microsoft marks one CVE Exploitation Detected and none publicly disclosed. Its FAQ says an attacker sends a crafted message file and convinces the user to open it; Outlook then connects to an attacker-controlled network location without the usual external-content warning and discloses the user’s NTLMv2 hash, which the attacker can use to authenticate as that user. The Preview Pane is not an attack vector this time. Two details in the record do not line up: the severity is Moderate and the CVSS vector carries E:U (exploit code maturity unproven) while the exploitation flag says Detected. CISA listed it on release day, with a 14-day due date and no forensic-triage requirement.
What should you patch first under BOD 26-04?
CISA added CVE-2026-124194 to KEV on 10 November with a 24 November due date and forensic triage not required: the 14-day tier, not the three-day one. In October, CISA gave a user-interaction Windows Shell bug three days and forensic triage, so user interaction alone does not decide it. The KEV entry gives no reasoning, so I do not know what separated the two. The CISA-ADP SSVC values were not in my data, so the other variables below are my calls and labelled as such. I add one override: a leaked hash from an administrator’s Outlook is a privileged credential, so those machines get three days. The second case is the exposure override: an unauthenticated LDAP bug with no exploitation that the model puts at about 14 days, and that I would patch on domain controllers in three.
CVE-2026-124194, Outlook, spoofing (NTLMv2 hash leak)
- Exploitation: Detected (MSRC) high: KEV: YES, added 2026-11-10, due 2026-11-24 (CISA catalogVersion 2026.11.10) low: Forensic triage: NO (CISA) low: Technical impact: PARTIAL, a credential and not code execution, my call low: Automatable: NO, the user must open a file, my call high: Exposure: YES, every mailbox accepts mail from the internet, my call outcome: Exploited, on KEV and reachable by any email, but partial impact (my call) and a click required. CISA's 14 days stands for most users. A stolen NTLMv2 hash is a relay or cracking target, so the blast radius is whatever that user can reach; on administrators' machines that is the domain.
CISA: 14 days, due 2026-11-24, no forensic triage
Do: patch Outlook by 2026-11-24, administrators within 3 days; block outbound TCP 445 and 139 today
CVE-2026-119958, Windows LDAP, remote code execution (domain controllers)
- KEV: NO (CISA catalogVersion 2026.11.10) high: Technical impact: TOTAL, code execution in the LDAP service, my call mid: Automatable: likely YES, unauthenticated LDAP calls, no public exploit, my call low: Exposure: NO, domain controllers should not face the internet, my call outcome: CVSS 9.8, no login, no click, Exploitation Less Likely. Any foothold inside the network reaches LDAP on every domain controller, and code in that service is code on the identity tier. That is why I override the model on these hosts.
Model: about 14 days (not exploited, not exposed)
Do: patch domain controllers within 3 days (tier-0 override)
Which other CVEs need attention this month?
| CVE | Product | CVSS | CWE | Severity | Exploitability | CPE | Tier |
|---|---|---|---|---|---|---|---|
| CVE-2026-116928 | Windows Search (reached through Exchange attachment indexing) | 9.8 | CWE-787 | Critical | Less Likely | cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:* (and 23 more) | Model: Tier 3, about 14 days. Exchange servers within 7 days, my call |
| CVE-2026-119958 | Windows LDAP | 9.8 | CWE-787 | Critical | Less Likely | cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:* (and 23 more) | Model: Tier 3. Domain controllers within 3 days (override) |
| CVE-2026-118207 | Exchange Server Subscription Edition | 8.8 | CWE-706 | Critical | More Likely | cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:* | Model: Tier 4. Within 14 days, my call (More Likely, low-privilege login) |
| CVE-2026-118146 | Active Directory Domain Services | 8.8 | CWE-863 | Critical | More Likely | cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:* (and 23 more) | Model: Tier 4. Domain controllers within 14 days, my call |
| CVE-2026-119952 | Windows Schannel | 8.1 | CWE-208 | Critical | More Likely | cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:* (and 23 more) | Model: Tier 3, about 14 days |
| CVE-2026-113862 | Windows NAT | 8.1 | CWE-416 | Critical | More Likely | cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:* (and 23 more) | Model: Tier 3, about 14 days on hosts that run NAT |
| CVE-2026-109459 | Message Queuing Queue Manager | 8.1 | CWE-122 | Critical | Less Likely | cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:* (and 23 more) | Model: Tier 3 where TCP 1801 is reachable |
| CVE-2026-112967 | Xbox Live Networking Service | 9.8 | CWE-122 | Critical | Less Likely | cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:* (and 17 more) | Model: Tier 3, about 14 days |
| CVE-2026-110043 | Outlook (Preview Pane is an attack vector) | 8.8 | CWE-122 | Critical | Less Likely | cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:* (and 2 more) | Model: Tier 4. Ships with the Outlook update above |
| CVE-2026-121663 | Visual Studio Code | 8.8 | CWE-184 | Important | More Likely | cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:* | Model: Tier 4. Developer machines within 14 days, my call |
| CVE-2026-121662 | Visual Studio Code | 8.6 | CWE-77 | Important | More Likely | cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:* | Model: Tier 4. Same update as CVE-2026-121663 |
| CVE-2026-96077 | Windows TCP/IP (denial of service) | 7.5 | CWE-476 | Important | More Likely | cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:* (and 23 more) | Model: Tier 4, about 60 days |
| CVE-2026-109469 | Entra Device Registration | 10.0 | CWE-639 | Critical | Less Likely | cpe:2.3:a:microsoft:entra_device_registration:-:*:*:*:*:*:*:* | None: Microsoft says it is fully mitigated, no customer action |
| CVE-2026-119990 | Azure OpenAI | 9.8 | CWE-306 | Critical | N/A | cpe:2.3:a:microsoft:azure_open-AI:*:*:*:*:*:*:*:* | Microsoft says customer action is required but publishes no steps; I do not know what they are |
15 CVEs score 9.8 or more with no login and no click. None is exploited.
How many of these vulnerabilities are reachable without authentication?
The CVSS vector Microsoft publishes as the CNA (privileges required, attack vector, user interaction) and Microsoft’s Exploitability Index for the latest software release. The index is Microsoft’s forecast, not evidence of exploitation, and cloud-service CVEs usually carry N/A. Counts are over all 1,095 Microsoft-numbered CVEs in the CVRF, including the Edge entry CVE-2026-122518.
| Privileges required | Detected | More Likely | Less Likely | Unlikely | N/A | Total |
|---|---|---|---|---|---|---|
| None (PR:N) | 1 | 5 | 370 | 23 | 4 | 403 |
| Low (PR:L) | 0 | 37 | 558 | 30 | 9 | 634 |
| High (PR:H) | 0 | 0 | 44 | 5 | 0 | 49 |
| No CVSS vector | 0 | 0 | 8 | 0 | 1 | 9 |
| Total | 1 | 42 | 980 | 58 | 14 | 1095 |
403 CVEs need no privileges, but only six of them are Detected or More Likely. Of the 42 More Likely flags, 37 sit on bugs that need a login first (PR:L), mostly elevation of privilege. Microsoft expects attackers to use what they already have, not to walk in.
| Attack vector | No UI (UI:N) | UI required (UI:R) | Total |
|---|---|---|---|
| Network (AV:N) | 88 | 252 | 340 |
| Adjacent (AV:A) | 15 | 0 | 15 |
| Local (AV:L) | 1 | 22 | 23 |
| Physical (AV:P) | 24 | 1 | 25 |
| Total | 128 | 275 | 403 |
88 CVEs are reachable over the network with no login and no click. That is the list to check against your exposure inventory, not the 1,095.
| Type | More Likely | Less Likely | Unlikely | N/A | Total |
|---|---|---|---|---|---|
| Remote Code Execution | 2 | 29 | 1 | 0 | 32 |
| Elevation of Privilege | 0 | 6 | 0 | 2 | 8 |
| Information Disclosure | 0 | 12 | 0 | 0 | 12 |
| Denial of Service | 1 | 26 | 0 | 0 | 27 |
| Security Feature Bypass | 0 | 5 | 0 | 0 | 5 |
| Spoofing | 0 | 3 | 0 | 1 | 4 |
| Total | 3 | 81 | 1 | 3 | 88 |
Of those 88, 32 are remote code execution and two are More Likely. Sixteen are Critical, 14 are Critical remote code execution, 15 score 9.8 or more, and none of the 15 is More Likely. A 9.8 is a severity, not a forecast.
| CVE | Title | CVSS | Vector | Severity | Exploitability |
|---|---|---|---|---|---|
| CVE-2026-124194 | Microsoft Outlook Spoofing Vulnerability | 6.5 | AV:N/AC:L/PR:N/UI:R/S:U | Moderate | Detected |
| CVE-2026-121663 | Visual Studio Code Security Feature Bypass Vulnerability | 8.8 | AV:N/AC:L/PR:N/UI:R/S:U | Important | More Likely |
| CVE-2026-121662 | Visual Studio Code Remote Code Execution Vulnerability | 8.6 | AV:L/AC:L/PR:N/UI:R/S:C | Important | More Likely |
| CVE-2026-113862 | Windows Network Address Translation (NAT) Remote Code Execution Vulnerability | 8.1 | AV:N/AC:H/PR:N/UI:N/S:U | Critical | More Likely |
| CVE-2026-119952 | Windows Schannel Remote Code Execution Vulnerability | 8.1 | AV:N/AC:H/PR:N/UI:N/S:U | Critical | More Likely |
| CVE-2026-96077 | Windows TCP/IP Denial of Service Vulnerability | 7.5 | AV:N/AC:L/PR:N/UI:N/S:U | Important | More Likely |
How do you detect exploitation of these CVEs?
Lead with the gap: a hash leak has no exploit on the endpoint to catch. What you see is the network outcome, an SMB or WebDAV connection to an address you do not own, and later the attacker using the hash. Memory-corruption bugs in LDAP, Search and MSMQ give little signal before exploitation, so the hunts below look for crashes and for services starting things they never start. Microsoft documents no workaround or mitigation for CVE-2026-124194 in the CVRF; the update is the fix. The Sysmon overlay that feeds these rules is PatchTuesday-2026-11.xml, include-only, to merge into your baseline.
| CVE | CWE | ATT&CK | Hunt | Rule |
|---|---|---|---|---|
| CVE-2026-124194 | CWE-356 | T1187 | Sysmon EID 3 from System (the kernel SMB client) or OUTLOOK.EXE to TCP 445 or 139 on a public address; firewall denies for the same flow; EID 1 rundll32 davclnt.dll,DavSetCookie for the WebDAV fallback; then NTLM logons (4624, type 3) for that user from addresses you do not know | SMB to a public IP (new); SigmaHQ 982e9f2d |
| CVE-2026-116928 | CWE-787 | T1190, T1203 | Sysmon EID 1 on Exchange servers: any child of SearchIndexer.exe, SearchProtocolHost.exe or SearchFilterHost.exe other than the Search hosts, WerFault or conhost; WerFault started by those processes (crash after a failed attempt) | Search child (new); Search or IIS crash (new) |
| CVE-2026-119958 | CWE-787 | T1210 | LDAP runs in LSASS: Application event 1000 for lsass.exe and WerFault started by lsass.exe on domain controllers; a domain controller rebooting on its own is the loud version | critical service crash (October); SigmaHQ a18e0862 |
| CVE-2026-118146 | CWE-863 | T1210 | AD DS runs in LSASS: Application event 1000 for lsass.exe and WerFault started by lsass.exe on domain controllers; a domain controller rebooting on its own is the loud version | critical service crash (October); SigmaHQ a18e0862 |
| CVE-2026-119952 | CWE-208 | T1210 | Schannel runs in LSASS: Application event 1000 for lsass.exe and WerFault started by lsass.exe on domain controllers; a domain controller rebooting on its own is the loud version | critical service crash (October); SigmaHQ a18e0862 |
| CVE-2026-109459 | CWE-122 | T1210 | Sysmon EID 1 children of mqsvc.exe; EID 3 peers of mqsvc.exe on TCP 1801 that are not expected senders | SigmaHQ 53207cc2 |
| CVE-2026-118207 | CWE-706 | T1190 | Script files written under the Exchange web directories; shells started by Exchange worker processes | Exchange web directory script write (October) |
| CVE-2026-121662 | CWE-77 | T1204.002 | Sysmon EID 1 children of Code.exe running script hosts, LOLBins or download cradles, after a workspace from a clone or download is opened | SigmaHQ 5a3164f2 |
| CVE-2026-121663 | CWE-184 | T1204.002 | Sysmon EID 1 children of Code.exe running script hosts, LOLBins or download cradles, after a workspace from a clone or download is opened | SigmaHQ 5a3164f2 |
| CVE-2026-110043 | CWE-122 | T1203 | Sysmon EID 1 children of OUTLOOK.EXE (shells, script hosts, LOLBins) | SigmaHQ 208748f7 |
My key takeaways
- Patch Outlook by CISA’s 24 November due date, administrators’ machines first, and block outbound SMB at the edge today. The block also covers the next forced-authentication bug, and CVE-2026-124194 will not be the last.
- Patch the Exchange servers’ Windows build, not only Exchange. CVE-2026-116928 lives in Windows Search and is reached by mail alone.
- Domain controllers get three days for CVE-2026-119958 regardless of the model. No exploitation is reported; the asset decides the deadline.
- Do not rank by the 9.8s. Fifteen zero-click CVEs score 9.8 or more and none is forecast as likely to be exploited, while the one being used scores 6.5 and is rated Moderate.
- Treat CVE-2026-109469 (Entra, CVSS 10.0) as a transparency record and not a task. Microsoft fixed it in the service.
Frequently asked questions
How many CVEs did Microsoft fix in November 2026 Patch Tuesday?
Microsoft’s November 2026 release note lists 1,094 CVEs. The public CVRF carries 1,095 Microsoft-numbered entries; the extra one, CVE-2026-122518, the only Microsoft-numbered Microsoft Edge (Chromium-based) entry, is an information disclosure bug rated Moderate. One CVE is exploited and none is publicly disclosed.
Which November 2026 Patch Tuesday CVE should I patch first?
Patch CVE-2026-124194, the Outlook spoofing bug Microsoft marks Exploitation Detected, by CISA’s 24 November due date, administrators’ machines within three days, and block outbound TCP 445 and 139 now. Then patch domain controllers for CVE-2026-119958 (LDAP, CVSS 9.8) and the Windows build on Exchange servers for CVE-2026-116928.
Are any November 2026 Patch Tuesday vulnerabilities exploited in the wild?
Yes, one: Microsoft marks CVE-2026-124194 in Outlook as Exploitation Detected. CISA added it to KEV on 10 November (catalogVersion 2026.11.10) with a 24 November due date under BOD 26-04 and no forensic-triage requirement.
Can CVE-2026-116928 be exploited without anyone opening an email?
Yes, according to Microsoft, an unauthenticated attacker sends an email with a crafted attachment, Exchange indexes it automatically through the Windows Search component, and the recipient does not need to open anything. It scores 9.8 and is rated “Exploitation Less Likely”.
Leave a Reply
You must be logged in to post a comment.