Microsoft Patch Tuesday November 2026: 1,342 CVEs, 2 exploited

Microsoft’s November 2026 Patch Tuesday release covers 1,342 CVEs, 68 of them rated Critical, and the update guide marks one as exploited in the wild: an Outlook spoofing flaw, CVE-2026-124194. A second item, an OpenSSH password bypass tracked as CVE-2026-123158, was added to the CISA KEV catalog on 2026-11-09 with a federal due date of 2026-11-12. This Microsoft Patch Tuesday November 2026 summary draws on the MSRC release notes. No publicly disclosed (but unexploited) zero-days are listed this month.

Zero-days and actively exploited flaws

CVE-2026-124194, Microsoft Outlook spoofing (Microsoft Office family). Microsoft rates it Moderate with a CVSS score of 6.5 and marks it as exploited. It was not listed as publicly disclosed before the fix. Details of the attacks, the attackers and the exact exploitation method have not been published in the material Microsoft released. Because Outlook is on nearly every endpoint and spoofing is a common step in phishing, treat the exploited flag as more important than the Moderate label.

CVE-2026-123158, OpenSSH password authentication bypass (azl3 openssh). The description says sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password bypass. For some account configurations, any password between 256 and 1024 characters succeeds. Alpine Linux is given as an example of a platform that uses musl libc without PAM. The CVSS score is 8.1 and the EPSS score is 16.5%.

The sources disagree on exploitation status. CISA lists the flaw in its Known Exploited Vulnerabilities catalog (added 2026-11-09, due 2026-11-12), while Microsoft’s own record does not flag it as exploited. CISA’s catalog entry says ransomware campaign use is unknown. We treat the CISA listing as the stronger signal, because KEV entries are based on evidence of exploitation.

Patch first: top priorities

1. CVE-2026-123158 (OpenSSH). It is in CISA KEV with a due date of 2026-11-12, which is two days away. Patch within hours for any internet-facing Linux host using musl libc without PAM, and update to OpenSSH 10.6p2 or later.
2. CVE-2026-124194 (Outlook spoofing). Exploited in the wild. Deploy the Office update to all mail clients first.
3. CVE-2026-116928 (Windows Search RCE, CVSS 9.8). Critical, highest score among the Windows client flaws, and widely present.
4. CVE-2026-119958 (Windows LDAP RCE, CVSS 9.8). Domain controllers and directory services should be early in the queue.
5. Outlook and Word RCE group (CVE-2026-110043, CVE-2026-110047, CVE-2026-110067, CVE-2026-110068, CVE-2026-111285, CVE-2026-111309, all CVSS 8.8). Document and mail based attack paths reach users directly, so ship them with the Outlook fix above.

Why this matters

This section is our analysis, not new facts. A release this large is mostly a scheduling problem. The two items with real-world exploitation signals are small and easy to deploy, so do not let them wait for the full monthly cycle. Elevation of privilege dominates the release (536 CVEs), which matters most after an attacker already has a foothold, so favour hosts that are exposed to email, browsing or SSH first. Hunting ideas that follow from the facts: look for unusual successful SSH logins on musl-based Linux hosts, especially long passwords, and review Outlook-delivered messages with spoofed sender display data.

Critical vulnerabilities

The table lists a selection of the Critical-rated items with the highest scores. CVSS is as published in the release data.

Other items of note outside the Critical label: CVE-2026-109469 (Entra Device Registration, elevation of privilege) scores 10.0 and is rated Critical, while CVE-2026-109467 (Azure DevOps Server, RCE) and CVE-2026-120002 (SharePoint Server, elevation of privilege) both score 9.9. CVE-2026-116945 (SQL Server RCE), CVE-2026-85844 (Kerberos elevation of privilege) and CVE-2026-88218 (Windows DNS RCE) score 9.8. Microsoft rates the last three Important rather than Critical, so filters on the severity label alone will rank them too low.

By the numbers

The count includes third-party and Linux component entries (the azl3 families), so the total is higher than a Windows-only release would suggest.

What to do

1. Deploy the OpenSSH fix for CVE-2026-123158 now to affected Linux hosts, and restrict SSH exposure until it is done, given the 2026-11-12 CISA due date.
2. Push the Office and Outlook updates to a pilot ring today, then to everyone within the week, covering CVE-2026-124194 and the Outlook and Word RCE group.
3. Patch domain controllers, LDAP and DNS servers, SQL Server and SharePoint after the above, in a staged window with a rollback plan.
4. Prioritise internet-facing and email-facing systems, then servers, then the remaining endpoints. Use CVSS together with exploitation status, not the severity label alone.
5. Check the MSRC entry for CVE-2026-124194 for updates, since exploitation details have not been published yet.

Related free tool: test how long a password would take to crack with our Password Strength Checker. It runs entirely in your browser and nothing you type is sent or stored.

Related coverage

• Microsoft Teams adds AI phishing detection for external chats
• ConnectWise Cloud Backup breach hits Microsoft 365 tenants
• Windows zero-days CVE-2026-81963, CVE-2026-85880 exploited

Sources

• MSRC November 2026 release notes
• MSRC: CVE-2026-124194
• MSRC: CVE-2026-123158
• CISA Known Exploited Vulnerabilities catalog
• FIRST EPSS