Warning: Microsoft Patch Tuesday November 2026 patches 1093 vulnerabilities (63 Critical ...

Warning: Microsoft Patch Tuesday November 2026 patches 1093 vulnerabilities (63 Critical, 1029 Important, 1 Moderate), Patch Immediately!

Last update: 12/11/2026

Affected software: Multiple Microsoft products.

Type: Several types, ranging from Elevation of Privilege to Remote Code Execution and Information Disclosure.

CVE/CVSS: Microsoft patched 1093 vulnerabilities in its November 2026 Patch Tuesday release, 63 rated as critical, 1029 rated important and 1 rated as Moderate. Also including a 0-day vulnerability that is actively exploited.

Number of CVE by type:

535 Elevation of Privilege vulnerabilities

296 Remote Code Execution vulnerabilities

156 Information Disclosure vulnerabilities

46 Denial of Service vulnerabilities

27 Security Feature Bypass vulnerabilities

11 Tampering vulnerability

22 Spoofing vulnerability

Microsoft -

Microsoft has released multiple patches for vulnerabilities covering a range of their products. These monthly releases are called “Patch Tuesday” and contain security fixes for Microsoft devices and software. Microsoft’s November 2026 Patch Tuesday includes 1093 vulnerabilities (63 Critical, 1029 Important, 1 Moderate), for a wide range of Microsoft products, impacting Microsoft Server and Workstations. This Patch Tuesday includes one actively exploited 0-Day vulnerability. Some other vulnerabilities are also more likely to be exploited soon, therefore urgent patching is advised.

The CCB would like to draw your attention to the actively exploited spoofing vulnerability in Microsoft Office Outlook (CVE-2026-124194). Organisations should also prioritise Internet-facing and business-critical systems, taking into account each system's exposure and potential business impact.

CVE-2026-124194: Microsoft Outlook Spoofing Vulnerability (Actively exploited / Zero-day)

Spoofing Vulnerability. CVE-2026-124194 affects Microsoft Office Outlook and has a CVSSv3 score of 6.5. It is rated Moderate. Microsoft has confirmed that the vulnerability was actively exploited before a patch was available ("Exploitation Detected"). CISA has also added it to its Known Exploited Vulnerabilities (KEV) catalog. An unauthenticated attacker could send a specially crafted message file and convince a target to open it in Outlook. Outlook could then connect to an attacker-controlled network location without showing the usual external-content warning, exposing the user's NTLMv2 hash. The attacker could use that hash to impersonate the user. The Preview Pane is not an attack vector.

CVE-2026-119952: Windows Schannel Remote Code Execution Vulnerability

Remote Code Execution Vulnerability. CVE-2026-119952 affects Windows Schannel and has a CVSSv3 score of 8.1. It is rated Critical, and Microsoft assesses exploitation as More Likely. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

CVE-2026-118146: Windows Active Directory Domain Services Remote Code Execution Vulnerability

Remote Code Execution Vulnerability. CVE-2026-118146 affects Windows Active Directory Domain Services (AD DS) and has a CVSSv3 score of 8.8. It is rated Critical, and Microsoft assesses exploitation as More Likely. An authenticated attacker could exploit an incorrect authorization flaw in AD DS. Successful exploitation could let the attacker execute code over the network on the affected system.

CVE-2026-118148: Active Directory Domain Services Elevation of Privilege Vulnerability

Elevation of Privilege Vulnerability. CVE-2026-118148 affects Active Directory Domain Services (AD DS) and has a CVSSv3 score of 7.5. It is rated Critical, and Microsoft assesses exploitation as More Likely. The vulnerability is caused by improper authentication. Successful exploitation could let an attacker gain SYSTEM privileges.

CVE-2026-118207: Microsoft Exchange Server Remote Code Execution Vulnerability

Remote Code Execution Vulnerability. CVE-2026-118207 affects Microsoft Exchange Server and has a CVSSv3 score of 8.8. It is rated Critical, and Microsoft assesses exploitation as More Likely. An authenticated attacker could send a specially crafted request to the server. User interaction is not required. Successful exploitation could let the attacker execute code over the network on the Exchange server.

CVE-2026-113862: Windows Network Address Translation (NAT) Remote Code Execution Vulnerability

Remote Code Execution Vulnerability. CVE-2026-113862 affects Windows Network Address Translation (NAT) and has a CVSSv3 score of 8.1. It is rated Critical, and Microsoft assesses exploitation as More Likely. The vulnerability is caused by a use-after-free flaw. Successful exploitation could let an attacker execute code on the affected system. No authentication or user interaction is required.

CVE-2026-120002: Microsoft SharePoint Server Elevation of Privilege Vulnerability

Elevation of Privilege Vulnerability. CVE-2026-120002 affects Microsoft SharePoint Server and has a CVSSv3 score of 9.9. It is rated Important, and Microsoft assesses exploitation as Less Likely. An authenticated attacker could exploit an incorrect authorization flaw in SharePoint. Successful exploitation could let the attacker gain elevated privileges over the network. No additional user interaction is required.

CVE-2026-116945: Microsoft SQL Server Remote Code Execution Vulnerability

Remote Code Execution Vulnerability. CVE-2026-116945 affects Microsoft SQL Server 2017, 2019, 2022 and 2025 and has a CVSSv3.1 score of 9.8. It is rated Important. Microsoft assesses exploitation as Less Likely. The vulnerability is caused by a heap-based buffer overflow. Successful exploitation could allow an unauthorized attacker to execute code over a network. No SQL Server credentials are required, and no user interaction is needed when the package runs automatically.

CVE-2026-119958: Windows LDAP Remote Code Execution Vulnerability

Remote Code Execution Vulnerability. CVE-2026-119958 affects Windows Lightweight Directory Access Protocol (LDAP) and has a CVSSv3 score of 9.8. It is rated Critical, and Microsoft assesses exploitation as Less Likely. The vulnerability is caused by an out-of-bounds write. Successful exploitation could let an unauthenticated attacker execute code on the affected system.

CVE-2026-116928: Windows Remote Code Execution Vulnerability

Remote Code Execution Vulnerability. CVE-2026-116928 affects the Windows component and has a CVSSv3 score of 9.8. It is rated Critical, and Microsoft assesses exploitation as Less Likely. The vulnerability is caused by an out-of-bounds write. An unauthenticated attacker could exploit the Windows component used by Microsoft Exchange Server by sending an email containing a specially crafted attachment. The recipient does not need to open the email. Successful exploitation could let an attacker execute code on the affected system.

CVE-2026-112967: Windows Xbox Live Networking Service Remote Code Execution Vulnerability

Remote Code Execution Vulnerability. CVE-2026-112967 affects the Windows Xbox Live Networking Service and has a CVSSv3 score of 9.8. It is rated Critical, and Microsoft assesses exploitation as Less Likely. The vulnerability is caused by a heap-based buffer overflow. The flaw allows an unauthorized attacker to execute code over a network.

The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.

The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion.

In case of an intrusion, you can report an incident via .

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.