November Patch Tuesday Offers an Overflowing Cornucopia of CVEs

Microsoft serves up an actively exploited Outlook zero-day, and a wave of critical Exchange, SharePoint, Windows , and LDAP bugs that exhausted defenders need to prioritize fast.

November offers up a veritable Patch Tuesday feast of vulnerabilities that are more likely to be exploited. In its second four-digit Patch Tuesday release in a row, Microsoft today addressed 1,093 security vulnerabilities, with 63 rated critical, and one zero-day in the mix (CVE-2026-124194, CVSS 6.5) that Microsoft confirmed is under active exploit.

"Most security teams haven’t quite recovered from the last month of bumper-to-bumper critical vulnerabilities, emergency patches, and '2shell'-branded everything , and we're yet again at another Patch Tuesday," says Jake Knott, head of threat intelligence at Watchtowr.

"Teams are really starting to feel the strain of working out what actually matters when there is fire after fire every day demanding immediate attention," he adds. "Our advice hasn't changed … start with what you actually have exposed to the Internet, then what's already being exploited in the wild, and only then everything else. Before going into panic mode, check whether you even use the vulnerable component, or meet the prerequisites for exploitation."

Related: OnlyFans Copyright Takedowns Expose Compromised Websites

To that end, security teams should prioritize CVE-2026-124194 , and not just because attackers are already targeting it. It's a spoofing vulnerability in Outlook that may not allow code execution, hence its moderate severity rating, but could allow the disclosure of an account’s NTLMv2 hash — and in turn, the target's login.

"To exploit it, an attacker sends a target a malicious Office file and convinces them to open it," explained Satnam Narang, senior staff research engineer at Tenable, in his monthly Patch Tuesday commentary. "If the attack succeeds, the attacker captures the victim's NT LAN Manager v2 (NTLMv2) hash, a value derived from their Windows password. The attacker may be able to relay it to other systems to sign in as the user, or crack it to recover the password."

Other Notable CVEs for November Patch Tuesday

Security teams should also prioritize a pair of critical remote code execution (RCE) vulnerabilities, in Exchange and SharePoint, respectively, that each open targets to any attacker with a low-privilege login.

The first, in Exchange Server ( CVE-2026-118207 , CVSS 8.8), "belongs in this week's emergency window for every Exchange Server Subscription Edition server you run," Automox researchers warned in their monthly Patch Tuesday bulletin , and "all an attacker needs to start is a low-level login."

It's an improper input validation that could allow an authenticated attacker with low-level access to send the server a specially crafted request and run code with no user interaction.

Related: The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience

"Code on an Exchange server reaches every mailbox it hosts," warned Automox researchers. "And Exchange usually holds broad rights in Active Directory, so the mailboxes are just the start."

Meanwhile, an important-rated flaw ( CVE-2026-120002 , CVSS 9.9) in SharePoint Server is an elevation of privilege vulnerability that needs quick addressing, according to Automox.

"The flaw is incorrect authorization," the researchers noted. "That 9.9 comes from a changed scope: a successful attack reaches past the vulnerable SharePoint component itself. An attacker who already holds a low-privileged account sends requests over the network and elevates their privileges, with no user interaction required."

Another critical RCE to watch out for, according to Automox, is CVE-2026-110043 (CVSS 8.8/10), a one-click heap-based buffer overflow in Outlook that uses the Preview Pane as an attack vector. A target must select a weaponized email so it displays in the Preview Pane for it to trigger the attacker's code, which runs with that user's permissions.

"Patch internet-facing Exchange and SharePoint servers, and book the Exchange restart now," the Automox researchers advised. "Push the Office update this week, then check the installed build, because a fully patched Windows dashboard says nothing Office. Rank by score and assessment, not label."

Related: Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles

Dustin Childs, head of threat awareness at the Zero-Day Initiative (ZDI), also identified a Windows RCE (CVE-2026-116928 , CVSS 9.8) as needing immediate attention.

"We start with Windows , which is reached through Exchange Server," he said in his November Patch Tuesday blog post , where he also listed 30 potentially wormable CVEs to patch quickly. "This bug allows an unauthenticated attacker to send an email with a specially crafted attachment that triggers the bug when the server automatically indexes it. The recipient never opens anything. It is a zero-click code execution bug on a high-value target. It’s also a CVSS 9.8 and clearly more severe than any of the nine patches Exchange receives this month."

And finally, Childs pointed to CVE-2026-119958 , an RCE bug in Windows Lightweight Directory Access Protocol (LDAP).

"This patch addresses a bug that allows an unauthenticated attacker to exploit an out-of-bounds (OOB) write (CWE-787) by sending crafted LDAP calls over the network, with no user interaction," he warned. "Since it runs code in the LDAP service context, it could be quite destructive, especially on Domain Controllers. Test and deploy this one quickly."

Childs also recommended testing and deploying patches for the wormable bugs quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange.

White the cornucopia of CVE this month, especially on the heels of the record October Patch Tuesday, may feel overwhelming, security teams should stick to best practices and not get overwhelmed, advises Tyler Reguly, associate director of security R&D at Fortra.

"I don't know everyone else, but I'm tired," he said via email, adding that he believes that, eventually, AI will finish turning up old bugs and teams can once again look forward to smaller Patch Tuesday releases. "I can only imagine that if I’m tired, admins and operations teams everywhere are also tired. I believe that we will make it through to the other side, if we prioritize updates and focus on what really matters. The noise is coming at us from all sides, and we need to cut through it and figure out what really matters to the business."

Senior Managing Editor, Dark Reading

Tara Seals is an award-winning journalist with 25+ years of experience as a reporter, analyst, and editor in the cybersecurity, communications, and technology spaces. As managing editor, she runs the newsroom at Dark Reading, leading a team of staff writers and freelance contributors. She also heads up strategy for a variety of in-depth, multichannel news coverage initiatives.

Prior to joining Dark Reading in 2022, Tara was editor-in-chief at cybersecurity stalwart Threatpost, and prior to that, the North American news lead for Infosecurity Magazine. She also spent 13 years working for other titles at Virgo Publishing (now part of Informa TechTarget), as executive editor and editor-in-chief at publications focused on communications service providers, channel partners, and enterprise mobile and video technology. In 2026, she was awarded a regional Azbee award for her in-depth coverage of the ongoing North Korean fake worker cyber campaign.

A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family, and is on a never-ending quest for good Mexican food in the Northeast.

Want more Dark Reading stories in your Google results?

2026 State of Cybersecurity Report: Bridging the Divide

2026 State of Cybersecurity Report: Bridging the Divide

The Autonomous Endpoint Management Advantage

The Autonomous Endpoint Management Advantage

The State of Cloud Security: The Latest Challenges

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

How Enterprises Are Developing Secure Applications

From Shadow AI to Rogue Agents: Securing the AI You Can't See

From Shadow AI to Rogue Agents: Securing the AI You Can't See

LLM Security Architecture: Building Secure AI Systems from the Ground Up

LLM Security Architecture: Building Secure AI Systems from the Ground Up

Resilient Architecture: Designing Systems That Survive Compromise

Resilient Architecture: Designing Systems That Survive Compromise

Prompt Injection 101: What It Is and How to Stay Ahead

Prompt Injection 101: What It Is and How to Stay Ahead

The Long Tail Is Now the Front Line: Reducing Frontier-AI & Third-Party App Risk

The Long Tail Is Now the Front Line: Reducing Frontier-AI & Third-Party App Risk