Microsoft’s November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194)

Microsoft patched 1093 CVEs in its November 2026 Patch Tuesday release, with 63 rated critical, 1029 rated as important, and one rated as moderate.

This month’s update includes patches for 287 products and components. The following table lists the products with the most CVEs patched this month. A full list of patched products is available in the appendix.

Elevation of Privilege (EoP) vulnerabilities accounted for 48.9% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 27.1%.

CVE-2026-124194 | Microsoft Outlook spoofing vulnerability

CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook. It received a CVSSv3 score of 6.5 and is rated moderate. An attacker could exploit this vulnerability by convincing a target to open a crafted Microsoft Office file. Successful exploitation would allow an attacker to obtain the target’s valid NTLMv2 hash, which can then be used to impersonate that user in follow-on attacks.

According to Microsoft, this vulnerability was exploited in the wild as a zero-day. Additionally, the advisory credits this discovery to a security researcher that used Claude, the large language model (LLM) from Anthropic, though no specific version of Claude was noted in the advisory.

CVE-2026-118146 | Windows Active Directory Domain Services remote code execution vulnerability

CVE-2026-118146 is an RCE vulnerability affecting Windows Active Directory Domain Services. It received a CVSSv3 score of 8.8 and is rated as critical. An authenticated attacker could exploit an incorrect authorization in Active Directory Domain Services to execute code over a network. Successful exploitation would allow an attacker to execute arbitrary code on the affected system. It was assessed as “Exploitation More Likely.”

CVE-2026-120002 | Microsoft SharePoint Server elevation of privilege vulnerability

CVE-2026-120002 is an EoP vulnerability affecting Microsoft SharePoint Server. It received a CVSSv3 score of 9.9 and is rated as important. An authenticated attacker could exploit an incorrect authorization in Microsoft Office SharePoint to elevate privileges over a network. Successful exploitation would allow an attacker to gain elevated privileges. It was assessed as “Exploitation Less Likely.”

CVE-2026-118207 | Microsoft Exchange Server remote code execution vulnerability

CVE-2026-118207 is an RCE vulnerability affecting Microsoft Exchange Server. It received a CVSSv3 score of 8.8 and is rated as critical. An authenticated attacker could send malformed input to Microsoft Exchange Server, causing code to execute over a network. Successful exploitation would allow an attacker to execute arbitrary code on the affected system. It was assessed as “Exploitation More Likely.”

CVE-2026-119952 | Windows Schannel remote code execution vulnerability

CVE-2026-119952 is an RCE vulnerability affecting Windows Schannel. It received a CVSSv3 score of 8.1 and is rated as critical. An unauthenticated attacker could exploit an observable timing discrepancy in Windows Schannel to execute code over a network. Successful exploitation would allow an attacker to execute arbitrary code on the affected system. It was assessed as “Exploitation More Likely.”

Additional Notable CVEs

The following CVEs also merit attention based on severity, exploitability, or CVSSv3 score:

Additional CVEs addressed this month are listed in Microsoft’s Security Update Guide .

A list of all the plugins released for Microsoft’s November 2026 Patch Tuesday update can be found here . As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

For more specific guidance on best practices for vulnerability assessments, refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable .

Active Directory Domain Services

Azure Confidential Clean Rooms

Azure Front Door (AFD)

Azure Managed Grafana

Azure NFS mount helper (aznfs)

Connected Devices Platform Service (Cdpsvc)

Data Sharing Service Client

Desktop Window Manager

HEIF Image Extensions

JDBC Driver for SQL Server

Kernel Transaction Manager

Microsoft 365 Agents SDK

Microsoft ActiveX Installer Service

Microsoft Authentication Library (MSAL) for Node.js

Microsoft Authentication Library for JavaScript

Microsoft Azure Kubernetes Service

Microsoft Bluetooth Driver

Microsoft Color Management

Microsoft Configuration Manager

Microsoft Dynamics 365 (on-premises)

Microsoft Entra Private Network Connector

Microsoft Exchange Server

Microsoft Graphics Component

Microsoft High Performance Computing (HPC) Pack

Microsoft Input Method Editor (IME)

Microsoft Local Security Authority Server (lsasrv)

Microsoft MCP Gateway

Microsoft Office Access

Microsoft Office Excel

Microsoft Office Outlook

Microsoft Office PowerPoint

Microsoft Office SharePoint

Microsoft Office Visio

Microsoft Office Word

Microsoft PowerShell Core

Microsoft Remote Registry Service

Microsoft Streaming Service

Microsoft Teams for Android

Microsoft Trace Data Helper

Microsoft WDAC OLE DB provider for SQL

Microsoft Windows App Store

Microsoft Windows Codecs Library

Microsoft Windows Media Foundation

Microsoft Windows SCSI Class System File

Microsoft Windows Component

Microsoft Windows Speech

Microsoft XPS Document Converter

Quality Windows Audio/Video Experience (QWAVE) service

Reliable Multicast Transport Driver (RMCAST)

Remote Desktop Client

Remote Desktop Gateway Service

Servicing Stack Updates

Software Protection Platform (SPP)

Virtual Hard Disk (VHD) Miniport Driver

Visual Studio Code - GitHub Pull Requests and Issues Extension

Windows Active Directory

Windows Active Directory Certificate Services

Windows Advanced Rasterization Platform

Windows Ancillary Function Driver for WinSock

Windows App Readiness Service

Windows AppX Deployment Service

Windows AppX Package Manager

Windows Audio Service

Windows Background Intelligent Transfer Service (BITS)

Windows Backup Engine

Windows Bind Filter Driver

Windows Biometric Service

Windows Bluetooth A2DP driver

Windows Bluetooth Port Driver

Windows Bluetooth Service

Windows Broadcast DVR User Service

Windows Broker Infrastructure Service

Windows Brokering File System

Windows CD-ROM Driver

Windows CNG Key Isolation Service

Windows COM+ Event System Service

Windows Camera Frame Server Monitor

Windows Client for NFS

Windows Clipboard Virtual Channel Extension

Windows Cloud Files Mini Filter Driver

Windows Composite Image File System

Windows Connected User Experiences and Telemetry

Windows Connection Manager Service

Windows Container Isolation FS Filter Driver (unionfs.sys)

Windows Container Manager Service

Windows Cred SSProvider Protocol

Windows Credential Manager

Windows Credential User Interface

Windows DPAPI (Data Protection Application Programming Interface)

Windows DWM Core Library

Windows Defender Firewall Service

Windows Deployment Services

Windows Device Association Service

Windows Device Inventory

Windows Devices Human Interface

Windows Diagnostic Policy Service

Windows Distributed File System (DFS)

Windows Distributed Transaction Coordinator

Windows Encrypting File System (EFS)

Windows Enhanced Storage

Windows Error Reporting

Windows Event Collector Service

Windows Event Logging Service

Windows Failover Cluster

Windows Fast FAT Driver

Windows File Server Resource Management Service

Windows FileCrypt Driver

Windows Filter Manager

Windows Filtering Platform (WFP)

Windows Function Discovery Resource Publication

Windows Function Discovery SSDP Provider

Windows Graphics Kernel

Windows IKE Extension

Windows IP Translation Configuration Service

Windows Image Acquisition

Windows Imaging Component

Windows Internet (wininet.dll)

Windows Internet Connection Sharing (ICS)

Windows Internet Information Services

Windows Inventory Backup

Windows Kernel-Mode Drivers

Windows LDAP - Lightweight Directory Access Protocol

Windows Language Experience Service

Windows Layer-2 Bridge Network Driver

Windows Link Layer Topology Discovery Protocol

Windows Link-Layer Discovery Protocol (LLDP)

Windows Local Security Authority Subsystem Service (LSASS)

Windows Local Session Manager (LSM)

Windows MIDI Service Module

Windows Management Instrumentation

Windows Management Services

Windows Message Queuing

Windows Message Queuing Queue Manager

Windows Microsoft Account Sign-in Assistant

Windows Microsoft DirectMusic

Windows Mobile Device Management

Windows Modern Device Management (MDM)

Windows Multiple Provider Router

Windows Network Address Translation (NAT)

Windows Network Connected Devices Auto-Setup Service

Windows Network Connection Broker

Windows Network File System

Windows Overlay Filter

Windows PCI Bus Driver

Windows Partition Management Driver

Windows Performance Counters

Windows Performance Monitor

Windows Phone Service

Windows Point-to-Point Protocol over Ethernet (PPPoE)

Windows Print Spooler Components

Windows PrintWorkflowUserSvc

Windows Program Compatibility Assistant Service

Windows Projected File System

Windows Projected File System Filter Driver

Windows Push Notification Core

Windows Push Notifications

Windows Raw Image Extension

Windows Redirected Drive Buffering

Windows Remote Access API

Windows Remote Access Connection Manager

Windows Remote Assistance

Windows Remote Desktop

Windows Remote Desktop Services

Windows Remote Procedure Call

Windows Remote Procedure Call Runtime

Windows Resilient File System (ReFS)

Windows Rich Text Edit Control

Windows SMB Server Network Transport Driver (srvnet.sys)

Windows Secure Kernel Mode

Windows Secure Socket Tunneling Protocol (SSTP)

Windows Security Account Manager

Windows Security Center

Windows Sensor Data Service

Windows Server for NFS

Windows Setup and Deployment

Windows State Repository Service

Windows StateRepository API

Windows Storage Spaces Controller

Windows Storport Miniport Driver

Windows Subsystem for Linux

Windows System Events Broker

Windows Task Scheduler

Windows Telephony Service

Windows Text Services Framework

Windows USB Audio Class driver (usbaudio.sys)

Windows USB Hub Driver

Windows USB Scanner Driver

Windows USB Video Driver

Windows USM Communication Manager

Windows Universal Disk Format File System Driver (UDFS)

Windows User Manager Service

Windows Virtual Filtering Platform (VFP)

Windows Volume Shadow Copy

Windows Wireless Networking

Windows XWizard Framework

Windows Xbox Live Networking Service

Windows exFAT File System

Windows iSCSI Target Service

Microsoft’s November 2026 Security Updates

Tenable plugins for Microsoft November 2026 Patch Tuesday Security Updates