Microsoft’s November 2026 Patch Tuesday, released on November 10, fixes 1,094 vulnerabilities according to SecurityWeek and CSO Online. One of them, an Outlook flaw, is already being exploited. CISA added it to its Known Exploited Vulnerabilities catalog the same day. SAP and Adobe also shipped large security updates on November 10. Here is what matters, in the order to deal with it.
The one exploited flaw: Outlook CVE-2026-124194
Microsoft marks CVE-2026-124194 as exploited. It is a spoofing flaw in Outlook rated moderate, with a CVSS score of 6.5. SecurityWeek describes the attack this way: an attacker sends a crafted message file, and when the victim opens it, Outlook connects to a location the attacker controls and exposes the user’s NTLMv2 password hash. The bug cannot be triggered through the Preview Pane, so the user has to open the file.
The score is low, but the risk is not. A stolen hash can be cracked offline or relayed to other systems, which is why CSO Online treats the flaw as urgent despite the rating. Both outlets report that Microsoft did not publicly disclose the flaw before the fix, and neither identifies any other publicly disclosed zero-day in this release. Microsoft gives no details about the attacks it has seen.
Affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. The fix arrives through Office updates, not the Windows cumulative update, so installing Windows updates alone does not close it.
The numbers, and why they differ
SecurityWeek breaks the 1,094 down by product: Windows 726, Office 174, SQL Server 59, developer tools 53, SharePoint Server 27, Azure 20 and Exchange Server 9. It adds that Microsoft also republished 165 third-party CVEs. That total is below October’s record of 1,413, SecurityWeek notes, but Microsoft has now fixed more than 5,000 vulnerabilities this year.
CSO Online counts 63 Critical fixes. Other outlets publish different totals, because tallies vary with what is included, such as flaws released earlier in the month or third-party CVEs. Treat any single figure as approximate and check Microsoft’s Security Update Guide for the exact list that applies to your systems.
CSO Online lists four fixes with a CVSS score of 9.8:
- CVE-2026-119958, a Windows LDAP remote code execution flaw.
- CVE-2026-118207, an Exchange Server remote code execution flaw.
- CVE-2026-112967, a remote code execution flaw in the Xbox Live Networking Service.
- CVE-2026-119990, an Azure OpenAI elevation of privilege flaw that Microsoft patched automatically, so customers do not need to act.
SecurityWeek also lists critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, the Malware Protection Engine and Azure Managed Grafana.
What CISA added on November 10
CISA’s alert of November 10 says it added six vulnerabilities to the KEV catalog “based on evidence of active exploitation”:
- CVE-2026-20320, Cisco BroadWorks, XML external entity reference.
- CVE-2026-111560, Barracuda Networks products, OS command injection.
- CVE-2026-111793, Openwave Messaging Webtop Media Transcoder.
- CVE-2026-116606, Barracuda Email Security Gateway, authentication bypass.
- CVE-2026-124194, Microsoft Outlook, the flaw above.
- CVE-2026-125350, Google Chromium, use-after-free.
CISA says all organizations, not only federal agencies, should prioritize KEV entries. Chrome is not covered by Microsoft’s count. CSO Online calls CVE-2026-125350 Chrome’s eighth zero-day of 2026, so check that Chrome and other Chromium-based browsers, including Edge, are on the latest version.
SAP: four maximum-severity flaws
SAP’s November 10 Patch Day is the other release to read closely. GBHackers reports 35 new security notes and four GitHub security advisories, and it names four flaws rated CVSS 10.0, all reachable over the network with no privileges and no user interaction:
- CVE-2026-76964, memory corruption in the Internet Communication Manager of NetWeaver AS ABAP.
- CVE-2026-89126, memory corruption in SAP Web Dispatcher.
- CVE-2026-89103, inadequate access control in SAP Gateway.
- CVE-2026-120017, missing authentication in the SAML2 Service Provider used by AS ABAP.
The first two share a root cause in how fragmented WebSocket messages are reassembled, according to RedRays, which also gives the SAP Note numbers: 3778530, 3778556, 3798345 and 3849308. Neither article says any of the four is being exploited. Disabling WebSockets is a possible stopgap for the first two, but it breaks features that use them. SAP customers should apply the notes through the SAP security notes portal. We could not open SAP’s own bulletin, which needs a login, so the details here come from these two reports.
Adobe
CSO Online reports that Adobe’s November updates fix 110 CVEs across nine bulletins, 22 of them critical, and that Adobe knows of no exploits in the wild. SecurityWeek puts the figure at roughly 110 vulnerabilities across nine products.
What to do first
- Update Microsoft 365 Apps or Office LTSC through your Office update channel to close CVE-2026-124194. Until then, avoid opening message files from unknown senders.
- Update Chrome, Edge and other Chromium browsers.
- Patch Exchange Server and any domain controllers exposed to the LDAP flaw, then roll out the regular Windows cumulative update.
- If you run SAP NetWeaver, Web Dispatcher or Gateway, apply the four CVSS 10.0 notes.
- Home users: let Windows Update and Office update run, and restart when asked.
What is still unknown
- Who is exploiting the Outlook flaw, and how widely. Microsoft has not said.
- The exact total. Published counts differ, and Microsoft’s Security Update Guide, which loads only in a browser, is the reference.
- Whether any of the SAP flaws are being used in attacks. Neither report says so.
This article is general information, not a substitute for your own security team’s advice.
Sources
- SecurityWeek: Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
- CSO Online: November 2026 Patch Tuesday
- CISA: Adds Six Known Exploited Vulnerabilities to Catalog (November 10, 2026)
- GBHackers: SAP November 2026 Patch Day
- RedRays: SAP Security Patch Day November 2026
Like our coverage? Add stepphase.com as a preferred source on Google to see more of our stories in Top Stories.
