Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday
Microsoft’s November security update addresses roughly 1,090 vulnerabilities across Windows, Office, Azure and the company’s other product lines, the second consecutive monthly release to exceed the totals of all previous years.
The release formally lists 1,094 CVEs, with Windows accounting for 726 and Office 174. A smaller number of patches went to SQL Server, Exchange Server, SharePoint Server, Azure and other products.
Despite the number of patches, only one flaw is under active attack, and none were publicly known before the release. Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, read that shift as a sign of changing attacker methods rather than diminished exploitation.
“While this is encouraging, it does not mean we’re seeing less exploitation in the wild,” he wrote in a blog post analyzing the updates. “It does mean we are seeing fewer 0-days exploited in the wild. This makes sense, as AI is better at reversing patches than it is at finding and exploiting bugs in closed-source software.”
The exploited zero-day flaw, CVE-2026-124194, is an Outlook spoofing vulnerability. A specially crafted message file makes Outlook connect to an attacker-controlled network location without the usual external-content warning. The flaw was added to CISA’s Known Exploited Vulnerability (KEV) list shortly after Microsoft released this month’s advisory.
The most severe fixes include CVE-2026-116928, a Windows Search vulnerability reachable through Exchange Server. “It is a zero-click code execution bug on a high-value target,” Childs wrote, more severe than any of the nine fixes Exchange receives this month. A separate Windows LDAP flaw, also rated 9.8, could be “quite destructive, especially on Domain Controllers,” he said.
The array of vulnerabilities was actually less than last month, which saw a record-breaking 1,413 defects affecting the company’s various enterprise products and services.
