Microsoft's November Patch Tuesday, released on November 10, addressed 1,093 security vulnerabilities across Windows, Office, Exchange Server, SharePoint, and its cloud services, with 63 rated critical. It was the second consecutive month above 1,000 fixes, following October's record release, and researchers say the scale reflects Microsoft's use of artificial intelligence tools since the summer to surface long-hidden flaws in its own products.
The one flaw that should move first is not the highest scoring. CVE-2026-124194, an Outlook spoofing vulnerability rated moderate at CVSS 6.5, is the only vulnerability in the release that Microsoft confirmed is already being exploited, and none of the flaws was publicly known before the patches arrived. Affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.
To exploit the Outlook flaw, an attacker sends a target a malicious Office file and convinces the person to open it. Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, disclosing the user's NTLMv2 password hash. That hash can be relayed to other systems to sign in as the user, or cracked in an attempt to recover the password itself. Microsoft credited an Anthropic researcher who used the Claude AI assistant with finding the vulnerability.
Two zero-click flaws carry far higher scores and need the same urgency. CVE-2026-116928, a CVSS 9.8 remote code execution flaw in the Windows Search component, can be reached through Exchange Server: an unauthenticated attacker sends an email with a specially crafted attachment, Exchange automatically processes the attachment for indexing, and the recipient never has to open anything. CVE-2026-119958, also rated 9.8, is an out-of-bounds write in the Windows Lightweight Directory Access Protocol service. Crafted LDAP requests can run code in the service without authentication or user interaction, putting domain controllers, and with them the wider Active Directory environment, at risk.
The rest of the priority list is familiar enterprise territory. CVE-2026-118207, a critical remote code execution flaw in Exchange Server Subscription Edition rated CVSS 8.8, needs only a low-privilege login. CVE-2026-120002 in SharePoint Server scores 9.9 despite carrying an Important label, because a low-privileged attacker can elevate privileges across a changed scope. Outlook also received a fix for CVE-2026-110043, a CVSS 8.8 heap-based buffer overflow triggered through the Preview Pane. A critical heap-overflow flaw in the Windows Xbox Live Networking Service, CVE-2026-112967, rounds out the four flaws rated 9.8. The Zero Day Initiative counted 30 potentially wormable vulnerabilities in the release.
The practical advice from researchers was consistent. Patch Exchange servers and domain controllers first, ring-fence network-facing services such as DNS, DHCP, and LDAP, and push the Office updates separately this week, then verify the installed Office build rather than trusting a Windows dashboard that says the system is fully patched. Score and exploitation likelihood, they argued, should outrank severity labels when the queue is this long.
For administrators, November underlines a structural change rather than a one-off emergency. Back-to-back four-figure Patch Tuesdays suggest automated bug hunting has permanently raised patch volume, even as the number of actively exploited flaws stays low. Teams that rank updates by exposure and reach, instead of trying to treat more than a thousand fixes as equal, will get through the new normal fastest.