Key Stats: 1,080 Fixes in Total
- Critical: 59
- Important: 1,019
- Moderate: 1
- Weaponized: 0
- Publicly Disclosed: 0
- Confirmed Exploitation Detected: 1
This is the largest Patch Tuesday release of the year by volume, covering Windows, Microsoft Office, Exchange Server, SharePoint, SQL Server, Azure services, Visual Studio, and core operating system components. Fifty-nine Critical vulnerabilities is a big number, and three of them share the release's top risk score, with a fourth sitting just one point behind.But the one vulnerability Microsoft flags as having confirmed, detected exploitation isn't Critical at all. It's rated Moderate. Its CVSS score is 6.5, among the lowest in this month's release. Nothing in this release is marked as weaponized or publicly disclosed, which makes the one confirmed exploitation case stand out even more.That's this month's lesson, and it's the same one as last month, just with the numbers moved around: severity and exploitation status are two different questions, and the second one matters more once an attacker is already in the picture.
CVE-2026-124194: The Moderate Bug That's Already Being Exploited
This is a Microsoft Outlook Spoofing vulnerability. Microsoft's own description is unusually plain about the mechanism: the product's user interface does not warn the user of an unsafe action, which lets an unauthorized attacker perform spoofing over a network.It carries a CVSS score of 6.5 and a Moderate severity rating, the only Moderate-rated vulnerability in this month's entire release. Its risk score, 24, sits near the bottom of the release rather than the top.What makes it the one to prioritize isn't its score. It's Microsoft's own Exploitability Assessment, which marks this as the only CVE this month with confirmed, detected exploitation. Every other vulnerability in the release, including all 59 Critical entries, carries a lower-urgency exploitability label or none at all. If you're triaging by CVSS score alone, this one will not be anywhere near the top of your list. If you're triaging by what Microsoft says is actually happening, it should be first.
A Four-Way Tie at the Top of the Severity Scale
Four vulnerabilities share the highest risk score in this month's release. Three of them are tied at a risk score of 89: CVE-2026-112967 (Windows Xbox Live Networking Service, Remote Code Execution), CVE-2026-116928 (Microsoft Exchange Server, Remote Code Execution), and CVE-2026-119958 (Windows LDAP, Remote Code Execution). All three are Critical, all three score 9.8 on CVSS, and all three are rated Exploitation Less Likely by Microsoft, meaning there's no confirmed exploitation behind any of them yet.The fourth, CVE-2026-119990 (Azure OpenAI, Elevation of Privilege), also scores 9.8 and Critical, with a risk score of 87. It's one of thirteen vulnerabilities this month with no Exploitability Assessment listed at all. Inference: this is plausibly because Microsoft manages Azure OpenAI as a hosted service and patches it centrally rather than leaving the fix to customers, similar to how some Azure/Entra vulnerabilities worked last month. Verify: the spreadsheet doesn't state this directly, and before telling customers no action is needed, this should be confirmed against Microsoft's own advisory for this CVE.Exchange Server and Active Directory Domain Services also show up among this month's highest-risk Remote Code Execution entries (CVE-2026-118207 and CVE-2026-118146, both risk score 84), and both are rated Exploitation More Likely rather than Less Likely, which is a meaningfully different signal worth weighing alongside the score itself.
The Preview Pane, Still an Attack Vector
Ten vulnerabilities this month are flagged with the same note we've seen in previous releases: the Preview Pane is an attack vector. That's up from four last month.Five of them sit at this month's second-highest risk tier (84): CVE-2026-110043 and CVE-2026-110068 (Outlook RCE), CVE-2026-110067 and CVE-2026-111285 (Word RCE), and CVE-2026-111289 (Office RCE). The remaining five run across PowerPoint, split between Remote Code Execution and Information Disclosure, at lower risk scores.The pattern is the same one worth repeating every month this shows up: no click, no macro, no "enable content" prompt. Simply previewing a file is enough. Attachment filtering and current Attack Surface Reduction rules matter more than ever when ten separate code paths this month route through the same UI feature.
SharePoint's Surface Keeps Growing, and This Time It's Spoofing
SharePoint carries 29 CVEs this month, up from 16 last month. The mix has shifted too. Spoofing is the largest single category this time, at 10 CVEs, ahead of Elevation of Privilege (9), Remote Code Execution (7), and Information Disclosure (3). Last month's SharePoint surface skewed toward RCE and EoP; this month, tricking a user or a system into trusting something it shouldn't is the bigger theme.The highest-risk SharePoint entry this month is CVE-2026-120002, an Elevation of Privilege vulnerability scoring 9.9 CVSS with a risk score of 78, rated Exploitation Less Likely. As before, the volume here is the story as much as any single CVE: restrict administrative privileges, monitor for unusual permission changes, and patch the full set rather than cherry-picking the highest score.
A New Name Worth Learning: Windows Advanced Rasterization Platform
Twenty-three Elevation of Privilege vulnerabilities this month trace back to Windows Advanced Rasterization Platform (ARP), a component that hasn't featured prominently in recent releases. Every one of them is marked Scope Changed and requires an authorized attacker acting locally, consistent root causes across the set are heap-based buffer overflows, use-after-free, and stack-based buffer overflows. Risk scores for this cluster run from 56 to 72.All 23 are rated Exploitation Less Likely, and none show confirmed exploitation. But 23 EoP vulnerabilities in a single, previously quiet component is worth flagging for asset inventory alone: verify whether Windows Advanced Rasterization Platform is in your environment and tracked the same way your more familiar Windows components are.
SQL Server's Repeat Offender: SQL Injection
Microsoft SQL Server carries 52 CVEs this month across Remote Code Execution and Elevation of Privilege. Within that set, eleven separate Elevation of Privilege CVEs (including CVE-2026-118105, CVE-2026-118109, CVE-2026-118110, and CVE-2026-118120, all CVSS 8.8, risk score 72) share the identical root cause: improper neutralization of special elements used in a SQL command, in other words, SQL injection, allowing an authorized attacker to elevate privileges over a network.Eleven CVEs from the same underlying vulnerability class, in the same product, in the same month, usually points to a specific code pattern recurring across SQL Server's codebase rather than twelve unrelated bugs. If you maintain SQL Server at scale, this cluster is worth patching as a set and asking your DBA team whether the pattern shows up anywhere else in custom stored procedures or extensions.
Hyper-V This Month: Elevation and Denial of Service, Not Remote Code Execution
Hyper-V carries 16 CVEs this month, spanning Elevation of Privilege, Denial of Service, Spoofing, and Security Feature Bypass. Every description this month requires an attacker to already have local or authorized access; none of the sixteen describe a guest virtual machine reaching the host, which is a different shape than the guest-to-host chain flagged in last month's release.The highest-risk entry in this set is CVE-2026-113753 (Elevation of Privilege, CVSS 8.2, risk score 79), one of five Hyper-V EoP vulnerabilities marked Scope Changed. If you run shared Hyper-V infrastructure, this month's set is lower-urgency than last month's host-breakout concern, but still worth patching as a group rather than individually.
How to Be the Hero This Month: Follow the Exploit, Not the Score
- Patch CVE-2026-124194 first. It's the only vulnerability this month with confirmed, detected exploitation, despite being the sole Moderate-rated entry in the release. Exploitability status outranks CVSS score every time the two disagree.
- Don't stop at the four highest-risk Criticals. CVE-2026-112967, CVE-2026-116928, and CVE-2026-119958 (all risk score 89) and CVE-2026-119990 (risk score 87) are this month's ceiling by score, even though none currently show confirmed exploitation.
- Confirm what "no Exploitability Assessment" means for your environment. Thirteen CVEs this month, mostly Azure and cloud-service items, carry no assessment at all. Verify with Microsoft's advisories whether that means the service is already patched centrally or whether action is still needed on your end.
- Treat the Preview Pane as a live attack surface again. Ten separate code paths this month rely on it, more than last month. Keep attachment filtering and Attack Surface Reduction rules current.
- Review SharePoint as a system, and watch for spoofing specifically. Spoofing, not RCE or EoP, is the largest category in SharePoint's 29 CVEs this month, a shift from last month's mix.
- Check whether Windows Advanced Rasterization Platform is in your environment. Twenty-three Elevation of Privilege CVEs trace to this one component this month; confirm it's tracked in your asset inventory and patch cadence the same way more familiar components are.
- Patch the SQL Server injection cluster as a set. Eleven separate CVEs this month share the same SQL injection root cause in SQL Server; ask your DBA team whether the underlying pattern appears anywhere else.
- Prioritize resilience alongside prevention. When prevention fails, recovery speed is what limits the damage. Absolute enables organizations to rapidly restore compromised endpoints at scale using firmware-embedded Absolute Persistence® and automated Absolute Rehydrate® capabilities, helping reduce downtime and operational strain during major incidents.
See the November 2026 Patch Tuesday Chart (PDF).
