Microsoft's November 2026 Patch Tuesday released a record 1,094 CVEs, marking the second consecutive month of surpassing previous annual totals, despite only one flaw, a moderate Outlook spoofing bug, being actively exploited. The release includes numerous wormable critical remote code execution vulnerabilities, such as CVE-2026-116928 and CVE-2026-119958, which require immediate attention from administrators, especially those managing critical infrastructure services. Analysts suggest the discrepancy between the high number of vulnerabilities and the low number of active exploits may indicate a shift in attacker strategies. Additionally, Windows 11 23H2 Enterprise and Education editions reached the end of their updates on the same day, emphasizing the importance of timely patching and migration planning
Microsoft November 2026 Patch Tuesday: 1,094 CVEs, One Exploited, Record-Breaking Volume
Microsoft's November 2026 Patch Tuesday shipped today with 1,094 CVEs, the second straight month above every prior annual record after October's ~1,474 drop. Yet only one flaw, the CVE-2026-124194 Outlook spoofing bug, was actually being exploited in the wild, and none were publicly disclosed before the patch. Despite the low active-exploit count, the release is packed with wormable Critical RCEs like the zero-click Exchange path CVE-2026-116928 and an LDAP flaw rated 9.8. Admins should patch identity infrastructure first, treat the 6.5-rated Outlook bug as critical anyway, and note that Windows 11 23H2 Enterprise and Education reached end of updates that same day.
