November 2026 Patch Tuesday briefing

Briefing

Active exploitation of an Outlook spoofing flaw makes Office patching the first priority in Microsoft’s November release, despite a 62% drop in critical vulnerabilities from October.

The November 10 release addresses 1,093 vulnerabilities, down 317, or 22.5%, from October’s 1,410. Critical flaws fell from 61 to 23, while the number of actively exploited vulnerabilities remained at one. November also includes 797 high-severity and 262 medium-severity vulnerabilities. None is listed in CISA KEV, and none was publicly disclosed before the fix.

The smaller release still presents elevated risk: 16 critical vulnerabilities score at least 9.0 and are reachable over the network without sign-in or user action. Windows has the largest product concentration, with 745 vulnerabilities; ESU has 658 overlapping entries. Elevation of privilege dominates the threat categories with 535 flaws, followed by 296 remote code execution vulnerabilities. Those concentrations make both Windows deployment coverage and network-reachable services central to the response.

Bottom line: Patch the exploited Outlook flaw first, then address unauthenticated network-critical exposure across Windows, SQL Server, Azure OpenAI, and Aspire.

Priority Vulnerabilities

CVE-2026-124194: Outlook spoofing under active exploitation

Exploited in the wild, this medium-severity Microsoft Office flaw enables Outlook spoofing over the network without sign-in, but requires user action. Its exploitation status puts it ahead of higher-scoring flaws in deployment priority. The weakness is CWE-356, product UI failing to warn users of unsafe actions. CVSS: 6.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C.

CVE-2026-112967: Xbox Live Networking Service code execution

This critical Windows and ESU vulnerability enables remote code execution through Xbox Live Networking Service. A network attacker needs neither sign-in nor user action, making affected service exposure the key deployment consideration. Microsoft rates exploitation less likely. The underlying weakness is CWE-122, heap-based buffer overflow. CVSS: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

CVE-2026-116928: Windows Search code execution

Windows Search has a critical remote code execution flaw affecting Windows and ESU. Exploitation is possible over the network without sign-in or user action, so patch applicability should be checked across both product groups. Microsoft rates exploitation less likely. The weakness is CWE-787, out-of-bounds write. CVSS: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

CVE-2026-116945: SQL Server code execution

This critical SQL Server remote code execution vulnerability places database infrastructure in the network-critical patching tier. An attacker requires no sign-in or user action. Microsoft rates exploitation less likely, but those access conditions warrant priority over flaws requiring credentials or interaction. The weakness is CWE-122, heap-based buffer overflow. CVSS: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

CVE-2026-119958: Windows LDAP code execution

This critical LDAP remote code execution flaw affects Windows and ESU, putting directory-service exposure in scope for prioritization. It is reachable over the network without sign-in or user action. Microsoft rates exploitation less likely. CWE-787 identifies an out-of-bounds write as the underlying weakness. CVSS: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

CVE-2026-85844: Windows Kerberos privilege elevation

This critical Windows and ESU flaw enables elevation of privilege in Kerberos, making it particularly relevant to identity infrastructure. A network attacker needs neither sign-in nor user action. Microsoft rates exploitation less likely. The weakness is CWE-288, authentication bypass using an alternate path or channel. CVSS: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

CVE-2026-88218: Windows DNS code execution

Windows DNS has a critical remote code execution vulnerability affecting Windows and ESU. Its network reachability, with no sign-in or user action required, places affected DNS infrastructure in the priority deployment group. Microsoft rates exploitation less likely. The underlying weakness is CWE-415, double free. CVSS: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

CVE-2026-88234: Windows iSCSI code execution

This critical iSCSI remote code execution flaw affects Windows and ESU, bringing affected storage-connected systems into the network-critical workload. Exploitation requires neither sign-in nor user action. Microsoft rates exploitation less likely. The weakness is CWE-763, release of an invalid pointer or reference. CVSS: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

CVE-2026-88243: Windows DHCP Server code execution

This critical Windows DHCP Server vulnerability enables remote code execution across affected Windows and ESU systems. A network attacker needs no sign-in or user action, making DHCP server coverage an explicit infrastructure patching requirement. Microsoft rates exploitation less likely. The weakness is CWE-125, out-of-bounds read. CVSS: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

CVE-2026-95882: DirectMusic stack buffer overflow

This critical DirectMusic remote code execution vulnerability affects Windows and ESU. Despite the component’s media-related name, its assessed access conditions are network-based, with no sign-in or user action required. Microsoft rates exploitation less likely. The underlying weakness is CWE-121, stack-based buffer overflow. CVSS: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

CVE-2026-95901: DirectMusic double-free code execution

A separate critical DirectMusic flaw enables remote code execution on Windows and ESU through a CWE-415 double-free weakness. A network attacker needs neither sign-in nor user action. Microsoft rates exploitation less likely; deployment verification should account for this distinct vulnerability alongside the other DirectMusic fix. CVSS: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

CVE-2026-96067: Color Management integer-overflow code execution

This critical Microsoft Color Management flaw enables remote code execution on Windows and ESU. It is reachable over the network without sign-in or user action, supporting inclusion in the priority Windows deployment group. Microsoft rates exploitation less likely. The weakness is CWE-190, integer overflow or wraparound. CVSS: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

CVE-2026-96078: Color Management memory-safety code execution

This separate critical Color Management remote code execution flaw also affects Windows and ESU, with no sign-in or user action required for a network attacker. Microsoft rates exploitation less likely. Its weaknesses are CWE-122, heap-based buffer overflow, and CWE-191, integer underflow, requiring coverage alongside the other Color Management fix. CVSS: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

CVE-2026-96157: Windows Media Foundation code execution

This critical Windows Media Foundation remote code execution flaw affects Windows and ESU. Its network attack path requires neither sign-in nor user action, placing it in the same deployment tier as the other unauthenticated Windows criticals. Microsoft rates exploitation less likely. The weakness is CWE-122, heap-based buffer overflow. CVSS: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

CVE-2026-118740: Aspire authorization bypass

This critical Aspire security feature bypass is reachable over the network without sign-in or user action. Application owners should explicitly check Aspire applicability rather than assume Windows deployment covers it. Microsoft rates exploitation less likely. The weakness is CWE-862, missing authorization. CVSS: 9.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C.

Other material critical exposure includes unauthenticated, no-interaction Windows VFP code execution, CVE-2026-95962, scoring 9.0, and Azure OpenAI privilege elevation, CVE-2026-119990, scoring 9.8. SharePoint Server privilege elevation, CVE-2026-120002, and Azure DevOps Server code execution, CVE-2026-109467, both score 9.9 and require a low-privilege account but no user action. Visual Studio Code code execution, CVE-2026-120779, scores 9.6 and requires user action but no sign-in.

Release Pattern

Windows accounts for roughly 68% of the release. ESU’s 658 entries overlap with Windows, so these product counts should not be added together. Microsoft Office follows with 204 vulnerabilities, then SQL Server with 54, Developer Tools with 50, and Azure with 22. The operational workload therefore spans endpoint management, infrastructure services, databases, and application platforms.

Elevation of privilege represents about 49% of all vulnerabilities; remote code execution accounts for another 27%. Information disclosure adds 156 flaws. The named Kerberos and LDAP issues connect the Windows concentration to identity infrastructure, while DNS, DHCP Server, iSCSI, and SQL Server make server-service coverage a separate priority from desktop deployment.

November’s lower total and critical counts reduce volume relative to October, not the importance of the leading flaws. Active exploitation remains unchanged at one vulnerability. The priority entries have no public exploit repositories or independent exploitation reports identified, so the exploited Outlook issue remains the clearest observed attack signal.

Detection and Response

Outlook exploitation review

For CVE-2026-124194, incident responders should focus review on affected Outlook deployments and reports of suspicious user interactions consistent with spoofing. The required user action is a meaningful investigative condition, but it does not establish a particular delivery method or exploit sequence.

Exposure and deployment validation

No named detection-tool coverage accompanies the priority vulnerabilities. Treat patch verification and exposure inventory as distinct tasks rather than assuming an alert will identify exploitation. For SQL Server CVE-2026-116945, establish which affected database systems are network-reachable. Apply the same service-level review to Windows LDAP, Kerberos, DNS, DHCP Server, and iSCSI.

The critical access conditions do not require internet exposure: network reachability is the stated prerequisite. Confirm affected services and update status across Windows and ESU inventories, and separately verify applicability for Aspire and Azure OpenAI.

Patching Plan

1. Office and endpoint operations: Patch exploited Outlook CVE-2026-124194 first and verify installation across affected Office deployments.

2. Windows operations and identity infrastructure: Deploy the network-critical Windows and ESU fixes described above, including LDAP, Kerberos, DNS, DHCP Server, iSCSI, Search, Xbox Live Networking Service, media components, and VFP. Verify service coverage as well as device-level deployment success.

3. Database, cloud, and application platform teams: Address SQL Server CVE-2026-116945, Azure OpenAI CVE-2026-119990, and Aspire CVE-2026-118740, validating the applicable remediation for each platform.

4. Collaboration and developer platform teams: Address the remaining critical SharePoint, Azure DevOps Server, Visual Studio Code, ASP.NET Core, and Microsoft Graph exposure, accounting for their differing account and user-action requirements.

5. Vulnerability management and product owners: Complete the remaining Windows, Office, SQL Server, Developer Tools, Azure, and other product-family updates. Use Microsoft’s 42 “exploitation more likely” assessments to refine the remaining queue, and reconcile deployment results against affected-asset inventories.