On 10 November 2026 Microsoft released its monthly security updates. Tenable counts 1,093 CVEs across 287 products and components: 63 critical, 1,029 important and one moderate. Almost half are elevation-of-privilege bugs and about 27% allow remote code execution. Office Word (65), Excel (64) and SQL Server (53) have the most fixes.
The zero-day: CVE-2026-124194 in Outlook. Microsoft says this spoofing flaw (CVSS 6.5, rated moderate) was "exploited in the wild as a zero-day". A crafted Office or message file can expose the user's NTLMv2 hash, which an attacker can use to impersonate them. The user has to open the file; the Preview Pane is not an attack vector. Affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 (32- and 64-bit). Microsoft has not said who was attacked or how widely. Tenable notes the advisory credits a researcher who used Anthropic's Claude to find it.
Other fixes to prioritise (none reported as exploited): CVE-2026-118207, critical remote code execution in Exchange Server (CVSS 8.8); CVE-2026-118146 in Active Directory Domain Services (8.8); CVE-2026-119952 in Windows Schannel (8.1); CVE-2026-120002, a SharePoint Server privilege escalation scored 9.9; and two Visual Studio Code flaws, CVE-2026-121662 (code execution, 8.6) and CVE-2026-121663 (security feature bypass, 8.8). Microsoft marks all of these "exploitation more likely".
Cyber Security News also lists critical flaws in the SMB transport driver, TCP/IP and LDAP in Windows Server, eight critical Hyper-V privilege escalations, and critical fixes for Azure OpenAI, Azure Managed Grafana and Microsoft Defender.
