Microsoft's November 2026 Patch Tuesday: One Flaw in 1,095 Scored 6.5, and it’s Under Attack

Microsoft’s only exploited vulnerability this month is rated Moderate - and carries the highest exploit-maturity rating Microsoft issues. It was found by a researcher using AI, and was already being used in the wild. Meanwhile the bug that actually rooted firewalls this month wasn’t Microsoft’s at all.

At a glance

Headline count is CVEs Microsoft classified with an Impact rating, excluding 267 republished third-party CVEs (Azure Linux / Mariner packages, Chromium CVEs assigned by Google). Including those the document carries 1,362 rows. Tenable and Krebs report 1,093, ZDI approximately 1,090, BleepingComputer 1,235 on a different basis. Ours comes from the 11 November revision. November is a 23% drop from October’s 1,418 — the second four-digit month, not a new record.

The release, by impact class

1,095 CVEs Microsoft authored.

Elevation of privilege is 49% of the release and needs a foothold first. Remote code execution is the class that moves without one. Tenable counts 287 affected products; the heaviest are Office Word (65), Office Excel (64) and SQL Server (53).

What actually matters this month

Five things, in priority order.

1. The only exploited Microsoft flaw scored 6.5 — and Microsoft rates its exploit maturity High

That is the top of the scale: widely available, reliable exploit code. CVE-2026-124194 is an Outlook flaw that leaks NTLM hashes, and the CVSS understates it because the impact is confidentiality-only with user interaction required. Of 1,095 CVEs, 1,084 are rated Unproven and one other sits at Proof-of-Concept. CVSS said Moderate. Exploit maturity said go now.

2. Its patch is not in the Windows cumulative update

The fix ships in Office security updates — Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 — not KB5132061. An estate that deploys the monthly Windows rollup and calls it done will still be exposed. CISA’s deadline is 24 November.

3. AI showed up on both sides of the same month

Microsoft credits the Outlook discovery to a researcher working “using Claude with Anthropic” — and the flaw was already being exploited when found. In the same window, attackers used AI assistance to build the php2shell exploit chain that rooted Palo Alto firewalls. Discovery and exploitation, both accelerated, in the same news cycle.

4. The month’s real damage came from PHP, not Microsoft

CVE-2026-109618 and CVE-2026-109619 are unauthenticated RCE in PHP core itself — EPSS 0.9999, the highest of any CVE in this window. Amazon’s honeypot caught an exploitation attempt four days before public disclosure, while still under embargo. At least 25 Palo Alto firewalls were rooted. None of it appears in a Patch Tuesday feed.

5. Volume keeps falling away from risk

1,095 Microsoft CVEs, one exploited — 0.09%. VulnCheck’s data shows published CVEs up 45% year on year while confirmed-exploited grew 10%, and the exploited share has fallen to 1.4% from a 2.7% peak. But median time from publication to exploitation dropped from 120 days to 80. The pile is diluting; the fuse is shortening.

Mitigation guidance

The five Microsoft fixes that need a plan, not just a patch. For each: what an attacker actually does with it, what to look for in your own estate, and what to do beyond deploying the update.

CVE-2026-124194 — Microsoft Outlook, NTLM hash disclosure

EXPLOITED · CVSS 6.5 · Exploit maturity: High · KEV due 24 Nov 2026 · CWE-356

Microsoft files it as spoofing; functionally it is a credential leak. A crafted message file makes Outlook reach out to an attacker-controlled location without the usual external-content warning, and Windows then authenticates automatically, handing over the user’s NTLMv2 hash. The 6.5 reflects confidentiality-only impact plus required interaction — it says nothing about what a relayed domain credential is worth.

How attackers exploit this

• Send a crafted message file; the user opens it. The Preview Pane is not a vector — the file must be opened.
• Outlook connects outbound and Windows auto-authenticates, exposing the NTLMv2 hash.
• Relay it live against any service lacking SMB/LDAP signing or Extended Protection for Authentication, or crack it offline at leisure.

What to look out for

• Outbound SMB (port 445) to external destinations shortly after a message file is opened.
• NTLM authentication attempts to internet destinations — check the NTLM Operational event log.
• Whether SMB signing, LDAP signing and EPA are actually enforced. They are what turns a leaked hash from a breach into a nuisance.
• No IOCs have been published and no actor has been named, so behavioural hunting is the only option.

Mitigation guidance

• Deploy the Office update, not just the Windows rollup. Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 carry the fix. This is the single most likely way to think you have patched and have not.
• Endpoints before servers. Delivery is by email and the target is a person.
• Enforce SMB and LDAP signing and Extended Protection for Authentication if you have not. They blunt relay for every future variant of this, not just this CVE.
• Block outbound SMB at the perimeter. There is rarely a legitimate reason for it.

CVE-2026-116928 — Windows Search Component, Remote Code Execution

CRITICAL · CVSS 9.8 · AV:N / PR:N / UI:N · Trigger: indexed attachment · Not yet exploited

Pre-authentication RCE with no user interaction. The detail that elevates it above the other 9.8s: a malicious attachment sent to an Exchange server gets processed automatically when indexed. Nobody opens anything. It needs both the Windows and the Exchange fix to be fully closed.

How attackers exploit this

• Send a crafted attachment to any mailbox on an Exchange server with indexing enabled.
• The search indexer parses it and executes, before a human sees the message.

What to look out for

• Exchange servers with content indexing enabled — which is most of them.
• Unexpected child processes from the search indexer or Exchange transport components.
• File servers with Windows Search enabled on shares that accept uploads.

Mitigation guidance

• Patch both Windows and Exchange. Half the fix leaves the path open.
• Treat it with the same urgency as the exploited item — unauthenticated, no interaction, and a delivery mechanism every organisation already runs.
• Confirm the update reached every server in the DAG, not just the one you tested.

CVE-2026-119958 — Windows LDAP, Remote Code Execution

CRITICAL · CVSS 9.8 · Out-of-bounds write · AV:N / PR:N / UI:N · Not yet exploited

Unauthenticated out-of-bounds write in the LDAP service. LDAP runs on every domain controller, which makes this the November equivalent of the DNS problem: the vulnerable service and the crown jewels are the same host.

How attackers exploit this

• Send crafted LDAP traffic to a reachable domain controller. No credentials, nothing clicked.
• Execute in the LDAP service context — on a DC, that is the directory itself.

What to look out for

• Which networks can reach 389/636 on your DCs. The answer is usually “more than you would like”.
• LDAP service crashes or restarts without a corresponding change.
• DCs exposed to guest, remote-access or OT segments.

Mitigation guidance

• Domain controllers first, before the general server estate. Everything else in the directory depends on them.
• Restrict LDAP reachability during rollout. Network controls buy time; only the patch removes the bug.
• While you are there: if LDAP signing is not enforced, this month gives you two independent reasons to fix that.

CVE-2026-88218 — Windows DNS Server, Remote Code Execution

CRITICAL · CVSS 9.8 · AV:N / PR:N / UI:N · 4 DNS CVEs this cycle · Not yet exploited

Unauthenticated remote code execution in Windows DNS, one of four DNS flaws this cycle and part of the 30 CVEs ZDI counts as wormable. In most estates DNS Server runs on domain controllers, so this lands in the same place as the LDAP flaw above — which means one maintenance window can close both.

How attackers exploit this

• Send a crafted packet to any reachable Windows DNS server.
• Execute in the DNS service context; on a co-resident DC that is a direct path to domain compromise.

What to look out for

• DNS servers sharing a host with Active Directory — inventory before you schedule, not during.
• Windows DNS reachable from user VLANs, remote-access ranges or the internet.
• The other three DNS CVEs in this release; patch them as one unit.

Mitigation guidance

• Combine with the LDAP patch into a single DC maintenance window. Two 9.8s on the same host justify moving the window forward.
• Internal-only is not a mitigation when the initial foothold is a phished laptop.
• Verify service health after the rollup — four DNS fixes in one cycle is a larger regression surface than usual.

CVE-2026-119952 — Windows Schannel, Remote Code Execution

CRITICAL · CVSS 8.1 · Exploitation More Likely · AV:N / PR:N / UI:N · Not yet exploited

Schannel is the Windows TLS implementation — it sits underneath anything that terminates an encrypted connection. It carries a lower score than the flaws above but one of very few “Exploitation More Likely” ratings in the release, which is Microsoft telling you where it expects the next weaponisation to come from.

How attackers exploit this

• Reach any service that terminates TLS through Schannel — IIS, RDP, LDAPS, SMB over TLS.
• Execute during the handshake, before authentication is reached.

What to look out for

• Every internet-facing Windows service that terminates TLS. The affected surface is larger than any single product name suggests.
• Schannel errors or handshake failures clustering in System event logs.

Mitigation guidance

• Weight the Microsoft assessment above the 8.1. “Exploitation More Likely” is a forward-looking judgement; CVSS is a static description.
• Internet-facing TLS terminators first, then internal.
• There is no configuration workaround — Schannel cannot be disabled. The update is the control.

Third-party releases

Where the exploitation actually is. Forty-two of the forty-three CVEs confirmed exploited in this window came from outside Microsoft. Nine of them are edge or perimeter devices.

PHP and Palo Alto

php2shell · EPSS 0.9999 · EXPLOITED

CVE-2026-109618 and CVE-2026-109619 are unauthenticated RCE in PHP core itself, disclosed 21 October. One corrupts memory during request cleanup after an out-of-memory condition; the other reuses stale request state on a recycled worker. They affect every PHP install that serves web requests — PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed — with mod_php worst, because exploitation happens before application code runs. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Amazon’s MadPot honeypot recorded an exploitation attempt on 17 October, four days before disclosure and still under embargo. Attackers chained it with a kernel privilege-escalation bug called Fragnesia to deploy root web shells on Palo Alto firewall management interfaces; Dream Research found at least 25 compromised. Palo Alto: “No special configuration is required to be affected.” Per SecurityWeek, the attackers used AI assistance to build the chain.

Ivanti

Connect Secure · chain closed · EXPLOITED

October’s brief flagged that the Connect Secure chain had an unpatched link. It is now closed. CVE-2026-111357 (CVSS 8.8, missing authentication in the dsinvoked root maintenance service) and CVE-2026-118527 (4.3, predictable identifiers enabling the upload race) shipped 29 October in 25.1.1.3 and 22.8R2.6. Both entered KEV on 30 October; the 118527 deadline is 13 November — two days away.

Volexity’s detail on UTA0576 is worth reading: the dsinvoked stage ran a Python payload that temporarily modified an in-memory library, redirected a maintenance task to execute as root, then restored the original configuration and memory state. No web shell, no persistent backdoor — commands rode over repeated HTTPS requests. Post-exploitation pulled Windows LAPS admin passwords and BitLocker recovery keys. The compromised appliance was fully patched at the time. “A clean integrity-check result alone does not exclude compromise.”

Adobe

110 CVEs · 9 bulletins · CRITICAL

Adobe Connect is the headline — APSB26-191, 24 CVEs of which 18 are Critical, topping out at CVSS 10.0 and reachable over the network with no authentication and no user interaction. ZDI calls it the biggest and most severe Adobe bulletin of the month. Experience Manager (APSB26-189) adds 14 more including four 9.9s needing only a low-privileged account.

Only those two are Priority 2; the remaining seven bulletins are Priority 3. Nothing in this month’s Adobe batch is exploited — but CVE-2026-48356, an unrestricted file upload in Commerce and Magento, entered KEV on 27 October with an EPSS of 0.475. That is the third consecutive month an Adobe Commerce flaw has been confirmed exploited.

SAP

43 notes · 12 HotNews · CRITICAL

Onapsis calls it a record: 43 new and updated Security Notes, 12 HotNews, and four CVSS 10.0 flaws, all unauthenticated. Two are the ICM2SHELL memory-corruption pair — CVE-2026-76964 (NetWeaver AS ABAP) and CVE-2026-89126 (Web Dispatcher and HANA XSA). CVE-2026-89103 is PROXYGATE, broken access control in SAP Gateway, and CVE-2026-120017 is missing authentication in the NetWeaver SAML2 service provider.

Two operational traps. PROXYGATE needs a manual profile-parameter change after patching — the patch alone does not close it. And the WebSocket-disabling workaround for ICM2SHELL is explicitly not recommended by SAP. Researchers handed SAP working exploits; no in-the-wild exploitation reported yet.

Edge appliances

Citrix · SonicWall · Barracuda · EXPLOITED

Barracuda is the newest: CVE-2026-116606 (auth bypass) and CVE-2026-111560 (OS command injection) are explicitly chained, Barracuda confirms attacks on “a small number of organizations”, watchTowr has published exploit code, and both are due 13 November.

SonicWall CVE-2026-19868 (7.1) lets a user with valid non-SAML credentials bypass SAML-enforced MFA on SSL-VPN. No workaround; fixes are 7.3.4-7013 and 8.2.3-8015, due 20 November. Citrix shipped CVE-2026-107406 (CVSS 9.5, SAML-configured NetScaler) on 8 October, and a separate php2shell rollup in 14.1-73.49 / 13.1-64.32 that also carries the September and October fixes.

Mozilla Firefox

160 · 99 CVEs · NO EXPLOITATION

Firefox 160 (MFSA 2026-125) shipped on Patch Tuesday with 99 CVEs — 57 High, 24 Moderate, 18 Low, and no Critical. ESR 115.45 and 153.7 shipped alongside, plus Thunderbird 160 and 153.7. Ninety-nine in one browser release is far above Mozilla’s historical norm and fits the same volume pattern as Microsoft’s, though Mozilla has not publicly attributed it to AI-assisted discovery.

Apple

A 2024 CVE, weaponised now · EXPLOITED

Apple shipped on 9 November across iOS/iPadOS 27.2.1, 26.7.3 and 18.7.12, plus three macOS branches. Three concurrent iOS branches is itself a signal — SANS’ Lee Neely: “I take notice when Apple releases fixes to more than two versions.”

The more interesting item is older. CVE-2024-27834 — a CVSS 5.5 Pointer Authentication bypass Apple patched in May 2024 — entered KEV on 4 November. Sekoia attributes exploitation to APT29 / Midnight Blizzard, delivered through compromised legitimate sites and a supply-chain compromise of the Plerdy SEO tracker, in a zero-click chain ending in a cookie-stealing infostealer. A two-and-a-half-year-old medium-severity bug, weaponised by a state actor.

What This Means If You Ship Software

The pattern that defines this month is not volume. It is that the two most consequential events — the discovery of Microsoft’s only exploited flaw, and the compromise of Palo Alto’s firewalls — both involved AI assistance, on opposite sides, within three weeks of each other. One researcher used it to find a bug that was already being exploited. One attacker used it to build a chain that rooted production appliances.

And the thing that actually got people breached was PHP: a dependency, not a product. Knowing what is inside your product and on your endpoints before the CVE lands is the whole game. That is the chain the OESIS Detection & Patching Dashboard maps: which application is installed, which CVEs it carries, and whether a patch exists yet.

Priority matrix

Four bands, hardest first. The band is set by exposure and exploitation, not by CVSS — which is why a 6.5 leads and a 10.0 sits at the bottom. Scoped to software most organisations actually run; the full dataset covers all 43 exploited CVEs and every vendor in the cycle.

P1 — NOW Within 24 hours 19 of 43 exploited

Confirmed exploited in the wild — observed, not predicted. Sorted newest first: the top rows are what last cycle did not cover.

The Microsoft and Chrome rows have no EPSS because the model had not scored them when this snapshot was taken. The remaining 24 exploited CVEs sit in media servers, backup appliances, developer tooling and the 8 October legacy batch; all 43 are searchable in the OPSWAT CVE Dashboard.

P2 — THIS WEEK Within 72 hours 12 of 32

Windows, unauthenticated, network-reachable, no user interaction. Nothing has to be clicked for these to change your exposure. Server roles first — and note that DNS and LDAP both land on domain controllers.

No EPSS column this month. At the time of this snapshot the model had scored only 1 of 1,095 Microsoft CVEs — against near-full coverage in October, from a run at almost the same hour. EPSS scores arrive on their own schedule, and a column of dashes would imply low risk rather than no data. For confirmed exploitation it was never the right ranking signal anyway.

P3 — THIS CYCLE Within 7 days 8 CVEs

Critical and reachable, but each needs a precondition — a credential, an authenticated session, a delivered file. The Proof-of-Concept row belongs here on exploit maturity regardless of its score.

P4 — NO ACTION Awareness only 4 CVEs

Service-side. Microsoft fixed these in their own estate; there is nothing for a customer to deploy. They lead a raw CVSS sort every month — which is exactly why they are listed here rather than left to confuse someone.

The 72-hour plan

What the priority matrix does not tell you.

What’s next on the calendar

Sources

Primary vendor advisories first.

1. Microsoft Security Response Center, CVRF document 2026-Nov, revision 2026-11-11 — canonical CVE list, Microsoft-assigned CVSS and temporal vectors.
2. CISA Known Exploited Vulnerabilities catalog and FIRST EPSS.
3. Zero Day Initiative, The November 2026 Security Update Review.
4. Tenable, November 2026 Patch Tuesday addresses 1,093 CVEs; Krebs on Security; Rapid7.
5. PHP Group advisories for CVE-2026-109618 and CVE-2026-109619; NCSC-NL php2shell product tracker; SecurityWeek on the Palo Alto compromises.
6. Volexity on UTA0576 and Ivanti Connect Secure; Ivanti security advisories for CVE-2026-111357 and CVE-2026-118527.
7. Onapsis, SAP Security Patch Day, November 2026.
8. Adobe Security Bulletins (APSB26-191, -189 and others).
9. Mozilla, MFSA 2026-125 (Firefox 160).
10. Citrix CTX697191; SonicWall SNWLID-2026-0014; Barracuda advisories; The Hacker News on CVE-2024-27834 and APT29.
11. VulnCheck on AI-discovered vulnerabilities and exploitation rates.

Methodology. The headline count is CVEs Microsoft classified with an Impact rating in the CVRF, excluding 267 republished third-party CVEs. Microsoft CVSS and exploit-maturity values are vendor-assigned from the CVRF; third-party CVSS comes from NVD or the vendor where CISA does not publish one. EPSS is a prediction model and is reported, never used to rank confirmed exploitation — this month it had scored only one of 1,095 Microsoft CVEs at the time of the pull, which is why it is absent from the Microsoft tables. The priority matrix is scoped to mainstream enterprise software; the underlying dataset covers all 43 CVEs confirmed exploited between 8 October and 10 November, and every vendor in the cycle. Exploitation status reflects CISA KEV and first-party vendor confirmation, not third-party claims.

Data as of 11 November 2026. CISA KEV and EPSS are updated continuously, and Microsoft revises the CVRF after release — figures here reflect the 11 November revision and the catalog as it stood that morning. Mitigation guidance is general and derived from each vulnerability’s published characteristics; it is not a substitute for testing against your own environment.