November 2026 Patch Tuesday

November 2026 Patch Tuesday: 1,093 Fixes, One Real Attack, and Microsoft Calls It "Moderate"

Before we get into it

Every second Tuesday of the month, Microsoft ships a big bundle of security fixes. People in security call it Patch Tuesday, and for most IT teams it means the same thing every month: a long list, not enough time, and the question of what to fix first.

This month's list is long again. Microsoft fixed 1,093 security bugs on Tuesday, November 10. Most of them nobody is attacking yet. But one of them is already being used by attackers right now, and here is the strange part: Microsoft rates it as one of the least serious bugs in the whole release. If your team sorts patches by Microsoft's label, that bug is sitting at the very bottom of your list.

So which bug is it, what does it actually let an attacker do, and what else in this release deserves your attention this week?

Read further ahead to find out.

First, a quick word on the numbers

Before the release went live, a few websites were already calling November "the quietest Patch Tuesday ever", with just one bug and no attacks. That was wrong. They were looking at an early version of Microsoft's data that only had a handful of cloud and browser fixes in it. The real release came out on Tuesday at 10 a.m. Pacific time, and it was big.

Help Net Security's November forecast had already said that several fixes from late October would be rolled into this month, so a tiny release was never likely.

I did not want to wait a day for the news write-ups, so I counted the bugs myself straight from Microsoft's own data in the Security Update Guide. Here is what was in it.

Everything in this post is about the 1,093. For comparison, I counted September and October the same way and got 972 and 1,408. That lines up with what was reported at the time: about 974 for September and 1,411 for October, which is also the number we used in our October post. So November is roughly 300 fixes lighter than October, but still bigger than September.

What kind of bugs were fixed?

Elevation of privilege means an attacker who already has a small foothold can make themselves an admin.
Remote code execution means an attacker can run their own programs on your machine, sometimes from far away. These are usually the scariest.
Information disclosure means the bug leaks data it should not.

In plain terms: November is smaller than October but bigger than September, and still over a thousand fixes. Microsoft rated 63 of them Critical, and flagged 42 as "more likely" to be attacked soon. Only one bug is confirmed as being attacked right now.

And here is roughly where the fixes landed. I grouped these myself using Microsoft's product tags.

The one bug attackers are already using

The bug to fix first this month is CVE-2026-124194, a flaw in Microsoft Outlook.

Microsoft scores it 6.5 out of 10 and rates it "Moderate". It is the only Moderate bug in the entire release. It is also the only bug this month that Microsoft says attackers are actively using. That mismatch is the main point of this post.

How the attack works, step by step:

The attacker sends you a specially made message file, by email or chat.
You open it in Outlook. (Just previewing it is not enough, you have to open it.)
Outlook quietly connects to a server the attacker controls. Normally Outlook warns you before it loads anything from outside. With this bug, the warning never appears.
Windows automatically "logs in" to that server, and in doing so it sends a scrambled version of your password, called an NTLM hash.
The attacker can now reuse that hash to pretend to be you on other systems in your network, or try to crack it to get your real password.

Microsoft credits a researcher named Benoît Sevens, working with Anthropic's Claude AI, for finding it. If the name sounds familiar, he was also credited on October's attacked Windows bug. That is two months in a row where the one bug under attack was reported by the same person using an AI tool.

When I checked, the bug had not yet been added to the US government's list of known exploited vulnerabilities, which CISA maintains. I expect it to show up there within days.

Why I think "Moderate" is the wrong label

A stolen password hash is rarely what an attacker really wants. It is the key they use to open the next door. In a company network where older login methods are still switched on, one leaked hash can be the first step to taking over much more. We saw almost exactly this with a famous Outlook bug back in 2023 (CVE-2023-23397).

One more small thing I noticed. Microsoft's own scoring data for this bug still says that working attack code is "unproven", while the same page says attacks have been detected. Those two cannot both be true. It sounds minor, but security tools that read that score will make this bug look even less urgent than it is.

What you can do right now, even before every laptop is patched:

Block outgoing file-sharing traffic (port 445) at your firewall. Microsoft explains how in its guide to securing SMB traffic.
Add your admin accounts to the Protected Users group. This stops their password hashes from being sent this way at all.
Turn on SMB signing and LDAP signing, so that even a stolen hash is much harder to reuse.

The bugs I would fix next

These are not under attack yet, but they sit on important servers and can be reached over the network. These are the ones attackers tend to go after first.

The Windows Search bug is the one that worries me most. An attacker only needs to send an email to an Exchange mailbox. Exchange processes the attachment by itself, so nobody has to open, click or even look at anything. If you run your own Exchange server, patch this right after Outlook.

Also look at the last three rows. DNS, DHCP and SQL Server all score 9.8 out of 10, yet Microsoft labels them only "Important". In total, 12 bugs this month score 9.8 or higher and are still not labelled Critical. Microsoft's reasoning is that the attacker has to be inside your network already. That is fair, but in real-world attacks "already inside" is very often the case.

AI is now finding a real share of these bugs

Last month SecurityWeek suggested that AI tools are a big reason these releases keep getting bigger. This month you can see it in Microsoft's own credits. 33 of the 1,093 bugs name an AI model as part of how they were found.

These are only the cases where the researcher chose to mention the tool, so the real number is almost certainly higher. That cuts both ways. More bugs being found and fixed is good news. But attackers have the same tools, and the time between "a bug exists" and "someone is using it" keeps getting shorter. Slow patching costs more than it used to.

What I like, and what I don't

The good. Microsoft's information this month is clear and detailed. For most bugs, it explains exactly what an attacker would need, which is the most useful thing a defender can get. Having all the data available the minute the release goes live is what made this post possible on day one. I also like that cloud and browser fixes now come out earlier in the month, so Patch Tuesday itself is focused on things you actually have to install.

The not so good. Microsoft's labels are drifting further away from real-world risk. In October, the bug under attack was rated "Important". This month it is rated "Moderate". Meanwhile 63 bugs are rated Critical and none of them are being attacked. If Microsoft will not raise a bug's rating once it is being exploited, then the "being exploited" flag should at least be the first thing every dashboard shows.

The early data also caused confusion. Several sites published "one bug, no attacks" headlines that were simply wrong because they read an incomplete file. That is not really Microsoft's fault, but a clear "Patch Tuesday has not shipped yet" note in the data would help everyone.

One reminder. Last month BleepingComputer noted that Windows 11 version 23H2 (Enterprise and Education) reaches the end of its security updates this month. If you still have those machines, treat this as their last update and plan to upgrade. You can check your exact version on Microsoft's Windows release health page.

Sources

Image credits: all three figures are original charts and diagrams made by FieldCISO for this post. Figures 1 and 3 use Microsoft's November 2026 release data, and Figure 2 is based on Microsoft's description of CVE-2026-124194.

November 2026 Patch Tuesday