[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxQz7Cegg_4u5o2jcya5PSGJIfnI9yQ_nKuwmgsj3Vxo":3},{"article":4,"iocs":48,"watch_terms":65,"solutions":66,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"5f610df3-2ba6-42db-a089-c0b320512145","Microsoft’s November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194)","microsoft-s-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194-7d3f81","63Critical 1029Important 1Moderate 0Low Microsoft addresses 1093 CVEs in the eleventh Patch Tuesday of 2026. Microsoft patched 1093 CVEs in its November 2026 Patch Tuesday release, with 63 rated critical, 1029 rated as important, and one rated as moderate. This month’s update includes patches for 287 products and components. The following table lists the products with the most CVEs patched this month. A full list of patched products is available in the appendix. RankProductCVE Count 1Microsoft Office Word65 2Microsoft Office Excel64 3SQL Server53 4Windows Advanced Rasterization Platform37 5Windows Installer36 6Windows Graphics Kernel35 7Windows Kernel28 8Microsoft Office SharePoint27 9Windows DNS22 10 (Tie)Microsoft Office Outlook20 10 (Tie)Windows Print Spooler Components20 Elevation of Privilege (EoP) vulnerabilities accounted for 48.9% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 27.1%. Moderate CVE-2026-124194 | Microsoft Outlook spoofing vulnerability CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook. It received a CVSSv3 score of 6.5 and is rated moderate. An attacker could exploit this vulnerability by convincing a target to open a crafted Microsoft Office file. Successful exploitation would allow an attacker to obtain the target’s valid NTLMv2 hash, which can then be used to impersonate that user in follow-on attacks. According to Microsoft, this vulnerability was exploited in the wild as a zero-day. Additionally, the advisory credits this discovery to a security researcher that used Claude, the large language model (LLM) from Anthropic, though no specific version of Claude was noted in the advisory. Critical CVE-2026-118146 | Windows Active Directory Domain Services remote code execution vulnerability CVE-2026-118146 is an RCE vulnerability affecting Windows Active Directory Domain Services. It received a CVSSv3 score of 8.8 and is rated as critical. An authenticated attacker could exploit an incorrect authorization in Active Directory Domain Services to execute code over a network. Successful exploitation would allow an attacker to execute arbitrary code on the affected system. It was assessed as “Exploitation More Likely.” Important CVE-2026-120002 | Microsoft SharePoint Server elevation of privilege vulnerability CVE-2026-120002 is an EoP vulnerability affecting Microsoft SharePoint Server. It received a CVSSv3 score of 9.9 and is rated as important. An authenticated attacker could exploit an incorrect authorization in Microsoft Office SharePoint to elevate privileges over a network. Successful exploitation would allow an attacker to gain elevated privileges. It was assessed as “Exploitation Less Likely.” Critical CVE-2026-118207 | Microsoft Exchange Server remote code execution vulnerability CVE-2026-118207 is an RCE vulnerability affecting Microsoft Exchange Server. It received a CVSSv3 score of 8.8 and is rated as critical. An authenticated attacker could send malformed input to Microsoft Exchange Server, causing code to execute over a network. Successful exploitation would allow an attacker to execute arbitrary code on the affected system. It was assessed as “Exploitation More Likely.” Critical CVE-2026-119952 | Windows Schannel remote code execution vulnerability CVE-2026-119952 is an RCE vulnerability affecting Windows Schannel. It received a CVSSv3 score of 8.1 and is rated as critical. An unauthenticated attacker could exploit an observable timing discrepancy in Windows Schannel to execute code over a network. Successful exploitation would allow an attacker to execute arbitrary code on the affected system. It was assessed as “Exploitation More Likely.” Additional Notable CVEs The following CVEs also merit attention based on severity, exploitability, or CVSSv3 score: CVEProductImpactCVSSv3ExploitabilityNotes CVE-2026-121663Visual Studio CodeSecurity Feature Bypass8.8Exploitation More LikelyImportant CVE-2026-121662Visual Studio CodeRemote Code Execution8.6Exploitation More LikelyImportant CVE-2026-113862Windows Network Address Translation (NAT)Remote Code Execution8.1Exploitation More LikelyCritical CVE-2026-105501Windows InstallerElevation of Privilege7.8Exploitation More LikelyImportant CVE-2026-105524Windows Management InstrumentationElevation of Privilege7.8Exploitation More LikelyImportant CVE-2026-109473Windows KernelElevation of Privilege7.8Exploitation More LikelyImportant CVE-2026-112811Windows Print Spooler ComponentsElevation of Privilege7.8Exploitation More LikelyImportant CVE-2026-116714Windows AppX Deployment ServiceElevation of Privilege7.8Exploitation More LikelyImportant CVE-2026-119818Windows Text Services FrameworkElevation of Privilege7.8Exploitation More LikelyImportant CVE-2026-119853Remote Access APIElevation of Privilege7.8Exploitation More LikelyImportant CVE-2026-119886Windows Telephony ServiceElevation of Privilege7.8Exploitation More LikelyImportant CVE-2026-119892Windows InstallerElevation of Privilege7.8Exploitation More LikelyImportant CVE-2026-119903Windows InstallerElevation of Privilege7.8Exploitation More LikelyImportant CVE-2026-83563WinlogonElevation of Privilege7.8Exploitation More LikelyImportant CVE-2026-88230Windows LUA File Virtualization Filter DriverElevation of Privilege7.8Exploitation More LikelyImportant Additional CVEs addressed this month are listed in Microsoft’s Security Update Guide. Tenable Solutions A list of all the plugins released for Microsoft’s November 2026 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched. For more specific guidance on best practices for vulnerability assessments, refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable. Product Appendix .NET AMD Zen ASP.NET Core Active Directory Domain Services ActiveSyncProvider Aspire Azure CLI Azure Confidential Clean Rooms Azure CycleCloud Azure DevOps Azure DevOps Server Azure File Sync Azure Firmware Azure Front Door (AFD) Azure Local Azure Managed Grafana Azure NFS mount helper (aznfs) Azure OpenAI Azure Pipelines Connected Devices Platform Service (Cdpsvc) Data Deduplication Data Sharing Service Client Desktop Window Manager Github Copilot Graphic Fonts HEIF Image Extensions HID Parser Library HID class driver JDBC Driver for SQL Server Kernel Transaction Manager Mailslot File System Microsoft 365 Agents SDK Microsoft Account Microsoft ActiveX Installer Service Microsoft Authentication Library (MSAL) for Node.js Microsoft Authentication Library for JavaScript Microsoft Azure Kubernetes Service Microsoft Bluetooth Driver Microsoft Color Management Microsoft Configuration Manager Microsoft Defender Microsoft Dynamics 365 (on-premises) Microsoft Entra Private Network Connector Microsoft Exchange Server Microsoft Graph Microsoft Graphics Component Microsoft High Performance Computing (HPC) Pack Microsoft Input Method Editor (IME) Microsoft JScript Microsoft Local Security Authority Server (lsasrv) Microsoft MCP Gateway Microsoft Office Microsoft Office Access Microsoft Office Excel Microsoft Office Outlook Microsoft Office PowerPoint Microsoft Office SharePoint Microsoft Office Visio Microsoft Office Word Microsoft PowerShell Microsoft PowerShell Core Microsoft QUIC Microsoft Remote Registry Service Microsoft Streaming Service Microsoft Teams Microsoft Teams for Android Microsoft Trace Data Helper Microsoft WDAC OLE DB provider for SQL Microsoft Windows App Store Microsoft Windows Codecs Library Microsoft Windows Media Foundation Microsoft Windows SCSI Class System File Microsoft Windows Search Component Microsoft Windows Speech Microsoft XPS Document Converter Quality Windows Audio\u002FVideo Experience (QWAVE) service RPC Runtime Reliable Multicast Transport Driver (RMCAST) Remote Desktop Client Remote Desktop Gateway Service Role: DNS Server SQL Server Secondary Logon Servicing Stack Updates Software Protection Platform (SPP) Storport.sys Driver Virtual Hard Disk (VHD) Miniport Driver Visual Studio Visual Studio Code Visual Studio Code - GitHub Pull Requests and Issues Extension Windows Active Directory Windows Active Directory Certificate Services Windows Admin Center Windows Advanced Rasterization Platform Windows Ancillary Function Driver for WinSock Windows App Readiness Service Windows AppContainer Windows AppX Deployment Service Windows AppX Package Manager Windows Audio Service Windows Autopilot Windows Background Intelligent Transfer Service (BITS) Windows Backup Engine Windows Bind Filter Driver Windows Biometric Service Windows BitLocker Windows Bluetooth A2DP driver Windows Bluetooth Port Driver Windows Bluetooth Service Windows Broadcast DVR User Service Windows Broker Infrastructure Service Windows Brokering File System Windows CD-ROM Driver Windows CNG Key Isolation Service Windows COM Windows COM+ Event System Service Windows Camera Frame Server Monitor Windows Client for NFS Windows Clipboard Virtual Channel Extension Windows Cloud Files Mini Filter Driver Windows Composite Image File System Windows Connected User Experiences and Telemetry Windows Connection Manager Service Windows Container Isolation FS Filter Driver (unionfs.sys) Windows Container Manager Service Windows Cred SSProvider Protocol Windows Credential Manager Windows Credential User Interface Windows DHCP Client Windows DHCP Server Windows DIAL Client Windows DNS Windows DPAPI (Data Protection Application Programming Interface) Windows DWM Core Library Windows Defender Firewall Service Windows Deployment Services Windows Device Association Service Windows Device Inventory Windows Devices Human Interface Windows Diagnostic Policy Service Windows DirectX Windows Distributed File System (DFS) Windows Distributed Transaction Coordinator Windows Encrypting File System (EFS) Windows Enhanced Storage Windows Error Reporting Windows Event Collector Service Windows Event Logging Service Windows Event Viewer Windows FTP Service Windows Failover Cluster Windows Fast FAT Driver Windows Feedback Hub Windows File Server Resource Management Service Windows FileCrypt Driver Windows Filter Manager Windows Filtering Platform (WFP) Windows Function Discovery Resource Publication Windows Function Discovery SSDP Provider Windows GDI Windows Graphics Kernel Windows HTTP.sys Windows Hyper-V Windows IKE Extension Windows IP Translation Configuration Service Windows Image Acquisition Windows Imaging Component Windows Input System Windows Installer Windows Internet (wininet.dll) Windows Internet Connection Sharing (ICS) Windows Internet Information Services Windows Inventory Backup Windows Kerberos Windows Kernel Windows Kernel-Mode Drivers Windows LDAP - Lightweight Directory Access Protocol Windows LUAFV Windows Language Experience Service Windows Layer-2 Bridge Network Driver Windows Link Layer Topology Discovery Protocol Windows Link-Layer Discovery Protocol (LLDP) Windows Local Security Authority Subsystem Service (LSASS) Windows Local Session Manager (LSM) Windows MIDI Service Module Windows Management Instrumentation Windows Management Services Windows Maps Windows Media Player Windows Message Queuing Windows Message Queuing Queue Manager Windows Microsoft Account Sign-in Assistant Windows Microsoft DirectMusic Windows Mobile Device Management Windows Modern Device Management (MDM) Windows Multiple Provider Router Windows NTFS Windows NTLM Windows NetBIOS Windows Network Address Translation (NAT) Windows Network Connected Devices Auto-Setup Service Windows Network Connection Broker Windows Network File System Windows ODBC Driver Windows OLE Windows OLE DB Windows Overlay Filter Windows PCI Bus Driver Windows Partition Management Driver Windows Performance Counters Windows Performance Monitor Windows Phone Service Windows Point-to-Point Protocol over Ethernet (PPPoE) Windows PowerShell Windows Print Spooler Components Windows PrintWorkflowUserSvc Windows Program Compatibility Assistant Service Windows Projected File System Windows Projected File System Filter Driver Windows Push Notification Core Windows Push Notifications Windows RNDIS Windows Raw Image Extension Windows Redirected Drive Buffering Windows Remote Access API Windows Remote Access Connection Manager Windows Remote Assistance Windows Remote Desktop Windows Remote Desktop Services Windows Remote Procedure Call Windows Remote Procedure Call Runtime Windows Resilient File System (ReFS) Windows Rich Text Edit Control Windows SMB Windows SMB Client Windows SMB Server Windows SMB Server Network Transport Driver (srvnet.sys) Windows SSDP Service Windows Sandbox Windows Schannel Windows Secure Kernel Mode Windows Secure Socket Tunneling Protocol (SSTP) Windows Security Account Manager Windows Security Center Windows Sensor Data Service Windows Server for NFS Windows Setup and Deployment Windows Shell Windows Smart Card Windows State Repository Service Windows StateRepository API Windows Storage Windows Storage Spaces Controller Windows Storport Miniport Driver Windows Subsystem for Linux Windows System Events Broker Windows TCP\u002FIP Windows TPM Windows Task Scheduler Windows Telephony Service Windows Text Services Framework Windows USB Audio Class driver (usbaudio.sys) Windows USB Driver Windows USB Hub Driver Windows USB Scanner Driver Windows USB Video Driver Windows USM Communication Manager Windows Universal Disk Format File System Driver (UDFS) Windows Update Stack Windows User Manager Service Windows VMSwitch Windows Virtual Filtering Platform (VFP) Windows Volume Shadow Copy Windows WLAN Service Windows Win32K Windows WinHTTP Windows Wireless Networking Windows XWizard Framework Windows Xbox Live Networking Service Windows eSCL Scanner Windows exFAT File System Windows iSCSI Windows iSCSI Target Service Winlogon Winsock Xbox vhdmp.sys Get more information Microsoft’s November 2026 Security Updates Tenable plugins for Microsoft November 2026 Patch Tuesday Security Updates","Microsoft's November 2026 Patch Tuesday release addresses 1093 CVEs across 287 products and components, with 63 rated critical and 1029 rated as important. The vulnerabilities patched include Elevation of Privilege (48.9%) and Remote Code Execution (27.1%). Notably, CVE-2026-124194, a moderate spoofing vulnerability in Microsoft Outlook, was exploited in the wild as a zero-day.","Microsoft November 2026 Patch Tuesday addresses 1093 CVEs, including 63 critical.","https:\u002F\u002Fwww.tenable.com\u002Fblog\u002Fmicrosoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194","https:\u002F\u002Fwww.tenable.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002F640x360\u002Fpublic\u002Fimages\u002Farticles\u002Fnovember-2026-patch-tuesday.png?itok=wLAKtXI9","2026-11-10T19:01:34+00:00","2026-11-10T20:00:09.554966+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Microsoft Office Word","product",{"name":21,"type":19},"Microsoft Office Excel",{"name":23,"type":19},"SQL Server",{"name":25,"type":19},"Windows Advanced Rasterization Platform",{"name":27,"type":19},"Windows Installer",{"name":29,"type":19},"Windows Graphics Kernel","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,56,59,62],{"type":50,"value":51,"context":52},"cve","CVE-2026-124194","Microsoft Outlook spoofing vulnerability, exploited in the wild as a zero-day.",{"type":50,"value":54,"context":55},"CVE-2026-118146","Windows Active Directory Domain Services remote code execution vulnerability, rated critical.",{"type":50,"value":57,"context":58},"CVE-2026-120002","Microsoft SharePoint Server elevation of privilege vulnerability, rated important.",{"type":50,"value":60,"context":61},"CVE-2026-118207","Microsoft Exchange Server remote code execution vulnerability, rated critical.",{"type":50,"value":63,"context":64},"CVE-2026-119952","Windows Schannel remote code execution vulnerability, rated critical.",[18,21,23],{"controls":67,"vendors":151},[68,97,122],{"slug":69,"name":70,"problem":71,"products":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":98,"name":99,"problem":100,"products":101},"patch-management","Automated patch management","Known holes get closed in days, not months.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":98,"product_name":119,"url":120,"description":121},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":123,"name":124,"problem":125,"products":126},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[152],{"slug":153,"name":154,"logo_path":155,"roles":156},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[157],"affected",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":168},"zero-day-in-outlook-highlights-urgency-of-timely-patching-across-massive-attack-surface","Zero-Day in Outlook Highlights Urgency of Timely Patching Across Massive Attack Surface","Microsoft's November 2026 Patch Tuesday addressed an extraordinary 1,093 CVEs across 287 products, including CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook that was actively exploited in the wild before a patch was available. The sheer volume of vulnerabilities — spanning Elevation of Privilege and Remote Code Execution categories — underscores how expansive Microsoft's attack surface has become and how quickly threat actors move to weaponize flaws. Zero-day exploitation means organizations had no patch window; defenses must assume breach potential until systems are updated. Delayed or inconsistent patch application across a large product estate dramatically increases the risk that even a 'moderate'-rated vulnerability can be leveraged for significant compromise. This event reinforces that patch management must be treated as a continuous, prioritized operational discipline rather than a periodic maintenance task.",[163,164,165,166,167],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-02: Incident Mitigation","NIS2 Article 21(2)(e)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"NIS2 Article 21(2)(e)":169,"NIST SP 800-53 SI-2: Flaw Remediation":170,"NIST CSF 2.0 RS.MI-02: Incident Mitigation":171,"CIS Control 7: Continuous Vulnerability Management (v8)":172,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":173},"NIS2 Article 21(2)(e) explicitly covers vulnerability handling and disclosure practices, requiring entities to have processes for timely remediation of vulnerabilities like those addressed in this Patch Tuesday release.","SI-2 mandates that organizations identify, report, and correct information system flaws within defined time frames, directly addressing the need to patch the actively exploited Outlook vulnerability without delay.","This category requires that organizations take actions to mitigate the impact of detected incidents, which applies here because zero-day exploitation demands immediate compensating controls while a patch is applied.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities — a process that would have flagged CVE-2026-124194 for emergency patching the moment it was disclosed as a zero-day.","A.8.8 requires organizations to obtain timely information about technical vulnerabilities and take appropriate measures, which would include prioritizing the zero-day Outlook patch upon Microsoft's disclosure."]