Microsoft Patch Tuesday, November 2026 Security Update Review
As the year approaches its final stretch, Microsoft’s November 2026 Patch Tuesday highlights the continued importance of proactive vulnerability management. This month’s security updates address vulnerabilities across the Microsoft ecosystem, reinforcing the need for organizations to promptly identify, prioritize, and remediate security risks.
This month’s release includes fixes for several vulnerabilities that could potentially enable remote code execution, privilege escalation, or denial-of-service attacks. As always, timely patch deployment is crucial to reduce exposure and ensure systems remain resilient against exploitation attempts.
In this month’s updates, Microsoft addressed 1235 vulnerabilities, including 63 critical and 1029 important-severity vulnerabilities. In the updates, Microsoft has addressed 142 vulnerabilities impacting Microsoft Edge (Chromium-based).
In this month’s updates, Microsoft has addressed only one vulnerability that has been exploited in the wild.
This month’s release includes fixes for several vulnerabilities that could potentially enable remote code execution, privilege escalation, or denial-of-service attacks. As always, timely patch deployment is crucial to reduce exposure and ensure systems remain resilient against exploitation attempts.
The November 2026 Microsoft vulnerabilities are classified as follows:
Zero-day Vulnerability Patched in November Patch Tuesday Edition
CVE-2026-124194: Microsoft Outlook Spoofing Vulnerability
An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file may cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning. Successful exploitation of the vulnerability may lead to disclosure of authentication information that could be used to impersonate the user.
Critical Severity Vulnerabilities Patched in November Patch Tuesday Edition
| CVE | Title | Description |
| CVE-2026-120003 | Microsoft Office Remote Code Execution Vulnerability | A heap-based buffer overflow flaw in Microsoft Office may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-118148 | Active Directory Domain Services Elevation of Privilege Vulnerability | An improper authentication flaw in Active Directory Domain Services may allow an authenticated attacker to elevate privileges over a network. |
| CVE-2026-119382 | Windows TPM Elevation of Privilege Vulnerability | A heap-based buffer overflow flaw in Windows TPM may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-119961 | Windows Internet Information Services Remote Code Execution Vulnerability | A race condition flaw in Windows Internet Information Services may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-119967 | Windows Message Queuing Queue Manager Remote Code Execution Vulnerability | A use-after-free flaw in Windows Message Queuing Queue Manager may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-119960 | Windows Hyper-V Elevation of Privilege Vulnerability | The use of an uninitialized resource flaw in Windows Hyper-V may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-119957 | Windows Remote Desktop Services Elevation of Privilege Vulnerability | A double-free flaw in Windows Remote Desktop Services may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-119962 | Windows CredSSP Remote Code Execution Vulnerability | A double-free flaw in Windows Cred SSProvider Protocol may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-119969 | Graphic Fonts Remote Code Execution Vulnerability | A heap-based buffer overflow flaw in Graphic Fonts may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-119966 | Windows Graphics Kernel Elevation of Privilege Vulnerability | An integer overflow or wraparound flaw in Windows Graphics Kernel may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-119958 | Windows LDAP – Lightweight Directory Access Protocol Remote Code Execution Vulnerability | An out-of-bounds write flaw in Windows LDAP – Lightweight Directory Access Protocol may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-119952 | Windows Schannel Remote Code Execution Vulnerability | An observable timing discrepancy in Windows Schannel may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-119951 | Windows Deployment Services Remote Code Execution Vulnerability | A use-after-free flaw in Windows Deployment Services may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-124185 | Microsoft Office Word Remote Code Execution Vulnerability | Use of an uninitialized resource in Microsoft Office Word may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-116928 | Windows Search Remote Code Execution Vulnerability | An out-of-bounds write flaw in Microsoft Windows Search Component may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-110043 | Microsoft Office Outlook Remote Code Execution Vulnerability | A heap-based buffer overflow flaw in Microsoft Office Outlook may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-119990 | Azure OpenAI Elevation of Privilege Vulnerability | A missing authentication for a critical function in Azure OpenAI may allow an unauthenticated attacker to elevate privileges over a network. |
| CVE-2026-120005 | Microsoft PowerPoint Remote Code Execution Vulnerability | A heap-based buffer overflow flaw in Microsoft Office PowerPoint may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-122194 | Microsoft Defender Remote Code Execution Vulnerability | A null pointer dereference flaw in Microsoft Defender may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-111289 | Microsoft Office Remote Code Execution Vulnerability | A use-after-free flaw in Microsoft Office may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-111285 | Microsoft Office Word Remote Code Execution Vulnerability | A heap-based buffer overflow flaw in Microsoft Office Word may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-114160 | Azure Managed Grafana Elevation of Privilege Vulnerability | Successful exploitation of the vulnerability may allow an unauthenticated attacker to elevate privileges over a network. |
| CVE-2026-110068 | Microsoft Office Outlook Remote Code Execution Vulnerability | A use-after-free flaw in Microsoft Office Outlook may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-111309 | Microsoft Office Outlook Remote Code Execution Vulnerability | Release of an invalid pointer or reference in Microsoft Office Outlook may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-118207 | Microsoft Exchange Server Remote Code Execution Vulnerability | An improper input validation flaw in Microsoft Exchange Server may allow an authenticated attacker to execute code over a network. |
| CVE-2026-125137 | Windows Graphics Kernel Elevation of Privilege Vulnerability | A heap-based buffer overflow flaw in Windows Graphics Kernel may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-125136 | Windows Network Connected Devices Auto-Setup Service Remote Code Execution Vulnerability | A heap-based buffer overflow flaw in Windows Network Connected Devices Auto-Setup Service may allow an unauthenticated attacker to execute code over an adjacent network. |
| CVE-2026-118145 | Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability | A use-after-free flaw in Windows Function Discovery SSDP Provider may allow an unauthenticated attacker to execute code over an adjacent network. |
| CVE-2026-118146 | Windows Active Directory Domain Services Remote Code Execution Vulnerability | An incorrect authorization flaw in Active Directory Domain Services may allow an authenticated attacker to execute code over a network. |
| CVE-2026-116710 | Windows Message Queuing Remote Code Execution Vulnerability | A heap-based buffer overflow flaw in Windows Message Queuing may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-125134 | Windows Function Discovery Resource Publication Remote Code Execution Vulnerability | A use-after-free flaw in Windows Function Discovery Resource Publication may allow an unauthenticated attacker to execute code over an adjacent network. |
| CVE-2026-118737 | Remote Procedure Call Runtime Remote Code Execution Vulnerability | An improper verification of cryptographic signature in Windows Remote Procedure Call Runtime may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-109459 | Windows Message Queuing Queue Manager Remote Code Execution Vulnerability | A heap-based buffer overflow flaw in Windows Message Queuing Queue Manager may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-113865 | Windows Hyper-V Elevation of Privilege Vulnerability | A time-of-check time-of-use (toctou) race condition flaw in Windows Hyper-V may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-113859 | Windows TCP/IP Remote Code Execution Vulnerability | A use-after-free flaw in Windows TCP/IP may allow an unauthenticated attacker to execute code over an adjacent network. |
| CVE-2026-113862 | Windows Network Address Translation (NAT) Remote Code Execution Vulnerability | A use-after-free flaw in Windows Network Address Translation (NAT) may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-113856 | Windows Hyper-V Elevation of Privilege Vulnerability | A heap-based buffer overflow flaw in Windows Hyper-V may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-112967 | Windows Xbox Live Networking Service Remote Code Execution Vulnerability | A heap-based buffer overflow flaw in Windows Xbox Live Networking Service may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-113825 | Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability | A race condition flaw in Windows SMB Server Network Transport Driver (srvnet.sys) may allow an authenticated attacker to execute code over a network. |
| CVE-2026-113752 | Windows Print Spooler Components Remote Code Execution Vulnerability | A use-after-free flaw in Windows Print Spooler Components may allow an unauthenticated attacker to execute code over an adjacent network. |
| CVE-2026-113753 | Windows Hyper-V Elevation of Privilege Vulnerability | An untrusted pointer dereference flaw in Windows Hyper-V may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-113749 | Microsoft Windows Codecs Library Remote Code Execution Vulnerability | A heap-based buffer overflow flaw in Microsoft Windows Codecs Library may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-114169 | Windows Raw Image Extension Remote Code Execution Vulnerability | A heap-based buffer overflow flaw in Windows Raw Image Extension may allow an unauthenticated attacker to execute code over a network. |
Microsoft Office Excel Critical Vulnerabilities
| CVE | Title | Description |
| CVE-2026-118702, CVE-2026-118296 | Microsoft Office Excel Remote Code Execution Vulnerability | A double-free flaw in Microsoft Office Excel may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-118701, CVE-2026-118297, CVE-2026-124170, CVE-2026-120788, CVE-2026-120786, CVE-2026-120789 | Microsoft Office Excel Remote Code Execution Vulnerability | A heap-based buffer overflow flaw in Microsoft Office Excel may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-118292, CVE-2026-118711 | Microsoft Office Excel Remote Code Execution Vulnerability | A stack-based buffer overflow flaw in Microsoft Office Excel may allow an unauthenticated attacker to execute code over a network. |
| CVE-2026-118713, CVE-2026-118730 | Microsoft Office Excel Remote Code Execution Vulnerability | A use-after-free flaw in Microsoft Office Excel may allow an unauthenticated attacker to execute code over a network. |
Microsoft Office Word Critical Vulnerabilities
| CVE | Title | Description |
| CVE-2026-119947, CVE-2026-113860, CVE-2026-113861, CVE-2026-113864 | Windows Hyper-V Elevation of Privilege Vulnerability | A use-after-free flaw in Windows Hyper-V may allow an authenticated attacker to elevate privileges locally. |
Windows Hyper-V Critical Vulnerabilities
| CVE | Title | Description |
| CVE-2026-119947, CVE-2026-113860, CVE-2026-113861, CVE-2026-113864 | Windows Hyper-V Elevation of Privilege Vulnerability | A use-after-free flaw in Windows Hyper-V may allow an authenticated attacker to elevate privileges locally. |
Windows Message Queuing Critical Vulnerabilities
| CVE | Title | Description |
| CVE-2026-119963, CVE-2026-119964 | Windows Message Queuing Remote Code Execution Vulnerability | A double-free flaw in Windows Message Queuing may allow an unauthenticated attacker to execute code over a network. |
Other Microsoft Vulnerability Highlights
| CVE | Title | Description |
| CVE-2026-119853 | Remote Access API Elevation of Privilege Vulnerability | An untrusted search path in Windows Remote Access API may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-121662 | Visual Studio Code Remote Code Execution Vulnerability | A command injection flaw in Visual Studio Code may allow an unauthenticated attacker to execute code locally. |
| CVE-2026-122175 | Windows Autopilot Elevation of Privilege Vulnerability | A use-after-free flaw in Windows Autopilot may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-121663 | Visual Studio Code Security Feature Bypass Vulnerability | An incomplete list of disallowed inputs in Visual Studio Code may allow an unauthenticated attacker to bypass a security feature over a network. |
| CVE-2026-119892, CVE-2026-105501 | Windows Installer Elevation of Privilege Vulnerability | An incorrect authorization flaw in Windows Installer may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-119903, CVE-2026-119398 | Windows Installer Elevation of Privilege Vulnerability | An improper access control flaw in Windows Installer may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-119886 | Windows Telephony Service Elevation of Privilege Vulnerability | A missing authentication for critical function in Windows Telephony Service may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-119818 | Windows Text Services Framework Elevation of Privilege Vulnerability | An incorrect authorization flaw in Windows Text Services Framework may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-119389 | Windows Storage Elevation of Privilege Vulnerability | A use-after-free flaw in Windows Storage may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-116714 | Windows AppX Deployment Service Elevation of Privilege Vulnerability | An incorrect authorization flaw in Windows AppX Deployment Service may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-119992 | Windows HTTP.sys Elevation of Privilege Vulnerability | A double-free flaw in Windows HTTP.sys may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-112745 | Azure DevOps Server Information Disclosure Vulnerability | A server-side request forgery flaw in Azure DevOps Server may allow an authenticated attacker to disclose information over a network. |
| CVE-2026-105524 | Windows Management Instrumentation Elevation of Privilege Vulnerability | A weak authentication flaw in Windows Management Instrumentation may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-83563 | Winlogon Elevation of Privilege Vulnerability | A heap-based buffer overflow flaw in Winlogon may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-109473 | Windows Kernel Elevation of Privilege Vulnerability | A use-after-free flaw in Windows Kernel may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-112811 | Windows Print Spooler Components Elevation of Privilege Vulnerability | A stack-based buffer overflow flaw in Windows Print Spooler Components may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-112798 | Windows NetBIOS Elevation of Privilege Vulnerability | A use-after-free flaw in Windows NetBIOS may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-95983 | Windows Graphics Kernel Elevation of Privilege Vulnerability | An untrusted pointer dereference flaw in Windows Graphics Kernel may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-112791 | Windows Print Spooler Components Elevation of Privilege Vulnerability | Time-of-check time-of-use (toctou) race condition in Windows Print Spooler Components may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-95988 | Windows Kernel Elevation of Privilege Vulnerability | An incorrect authorization flaw in Windows Kernel may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-113819 | Desktop Window Manager Elevation of Privilege Vulnerability | A use-after-free flaw in Desktop Window Manager may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-112970 | Windows SMB Client Elevation of Privilege Vulnerability | A use-after-free flaw in Windows SMB Client may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-112759 | Windows Task Scheduler Elevation of Privilege Vulnerability | A heap-based buffer overflow flaw in Windows Task Scheduler may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-88238 | Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability | A heap-based buffer overflow flaw in Windows Camera Frame Server Monitor may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-97013 | Windows Shell Elevation of Privilege Vulnerability | A type confusion flaw in Windows Shell may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-95963 | Data Sharing Service Client Elevation of Privilege Vulnerability | A link following flaw in Data Sharing Service Client may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-96126 | Windows Graphics Kernel Elevation of Privilege Vulnerability | A heap-based buffer overflow flaw in Windows Graphics Kernel may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-94514 | Windows Kernel Elevation of Privilege Vulnerability | A race condition flaw in Windows Kernel may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-88242 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | A use-after-free flaw in Windows Ancillary Function Driver for WinSock may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-96077 | Windows TCP/IP Denial of Service Vulnerability | A null pointer dereference flaw in Windows TCP/IP may allow an unauthenticated attacker to deny service over a network. |
| CVE-2026-95989 | vhdmp.sys Elevation of Privilege Vulnerability | A use-after-free flaw in vhdmp.sys may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-88235 | Servicing Stack Updates Elevation of Privilege Vulnerability | Unintended proxy or intermediary in Servicing Stack Updates may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-95935 | Windows Graphics Kernel Elevation of Privilege Vulnerability | An integer overflow or wraparound flaw in Windows Graphics Kernel may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-95874 | Xbox Gaming Services Elevation of Privilege Vulnerability | A heap-based buffer overflow flaw in Xbox may allow an authenticated attacker to elevate privileges locally. |
| CVE-2026-88230 | Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability | A heap-based buffer overflow flaw in Windows LUAFV may allow an authenticated attacker to elevate privileges locally. |
Microsoft Release Summary
This month’s security updates cover the following Microsoft product families:
| Product Family | Vulnerabilities | Distinct Updates |
| Azure | 20 | |
| Defender | 1 | 1 |
| Developer Tools | 53 | 28 |
| Exchange Server | 9 | 1 |
| Office | 174 | 7 |
| Other | 25 | |
| SQL Server | 59 | 13 |
| SharePoint Server | 27 | 3 |
| Windows | 726 | |
| Total | 1094 | 53 |
The next Patch Tuesday is scheduled for December 8, and we will provide details and patch analysis then. Until next Patch Tuesday, stay safe and secure. Be sure to subscribe to the ‘This Month in Vulnerabilities and Patches’ webinar.’
Qualys Monthly Webinar Series
The Qualys Research team hosts a monthly webinar series to help our existing customers leverage the seamless integration between Qualys Vulnerability Management, Detection & Response (VMDR), and Qualys TruRisk Eliminate. Combining these two solutions can reduce the median time to remediate critical vulnerabilities.
During the webcast, we will discuss this month’s high-impact vulnerabilities, including those highlighted in this month’s Patch Tuesday alert. We will walk you through the necessary steps to address the key vulnerabilities using Qualys VMDR and Qualys TruRisk Eliminate.
Join the webinar
This Month in Vulnerabilities & Patches