Patch Tuesday November 2026
Microsoft’s November 2026 security update release: 1096 CVEs, 1 exploited in the wild, 64 rated critical. Severity, CVSS and affected product families from the MSRC Security Update Guide.
2026-11-01
1096CVEs, Microsoft CNA
1Exploited in the wild
64Critical
0Publicly disclosed
This release is still being updated by Microsoft. Numbers change as CVEs are published; the page refreshes hourly.
Exploited in the wild
| CVE | Vulnerability | Severity | CVSS | Impact |
|---|---|---|---|---|
| CVE-2026-124194 | Microsoft Outlook Spoofing Vulnerability Office | Moderate | 6.5 | Spoofing |
Critical
By impact
| Denial of Service | 46 |
| Elevation of Privilege | 536 |
| Information Disclosure | 157 |
| Remote Code Execution | 297 |
| Security Feature Bypass | 27 |
| Spoofing | 22 |
| Tampering | 11 |
By product family
| .NET | 36 |
| Azure | 19 |
| Dynamics 365 | 1 |
| Edge | 1 |
| Exchange Server | 9 |
| Office | 175 |
| Other | 21 |
| SQL Server | 53 |
| SharePoint | 27 |
| Teams | 3 |
| Windows | 751 |
Counts include CVEs where Microsoft is the assigning CNA. Third-party CVEs (for example Chromium in Edge) are excluded. Severity, CVSS and exploitation status are Microsoft's published values. See the full advisory list to search every CVE.