WORLDTECHMicrosoft's November 2026 security update covers 1,328 security flaws, 60 rated critical
AI illustration
Microsoft has issued its monthly security update for November 2026, covering 1,328 vulnerabilities in a range of its products, 60 of which the company marked as critical. According to the update, one of the disclosed flaws has already been exploited in the wild.
Scale and severity of the release
The update lists 1,328 vulnerabilities affecting a range of Microsoft products, among them 60 that the company marked as critical. Of those critical entries, 45 are remote code execution (RCE) vulnerabilities.
A separate tally in the source material gives a different picture, reporting 64 critical vulnerabilities within a total of 1,095. The figures in the sources are not consistent with one another, so the totals should be read with that in mind.
Vulnerability already exploited in the wild
Microsoft notes that one of the vulnerabilities disclosed this month has been exploited in the wild. The flaw, CVE-2026-124194, affects Microsoft Office Outlook and is a spoofing vulnerability in which the product interface does not warn users about unsafe actions. It has a CVSS base score of 6.5.
Flaws Microsoft considers more likely to be exploited
Microsoft considers exploitation of several vulnerabilities more likely. CVE-2026-113862 affects Windows Network Address Translation (NAT) and is a remote code execution flaw involving use after free, with a CVSS base score of 8.1. The same group includes CVE-2026-118146, a remote code execution flaw tied to incorrect authorisation scored 8.8; CVE-2026-118148, an elevation of privilege flaw from incorrect authorisation scored 7.5; CVE-2026-118207, a remote code execution flaw scored 8.8; and CVE-2026-119952, a remote code execution flaw involving an observable timing discrepancy scored 8.1.
Windows Message Queuing and Hyper-V entries
Microsoft considers exploitation of CVE-2026-109459 and CVE-2026-119967, both affecting the Windows Message Queuing Queue Manager, less likely. CVE-2026-109459 is a heap-based buffer overflow remote code execution flaw scored 8.1. Further Message Queuing entries are CVE-2026-116710, CVE-2026-119963 and CVE-2026-119964; CVE-2026-119963 is a double-free remote code execution flaw scored 8.1.
Eight elevation of privilege flaws affect Windows Hyper-V: CVE-2026-113753, CVE-2026-113856, CVE-2026-113860, CVE-2026-113861, CVE-2026-113865, CVE-2026-119947, CVE-2026-119960 and CVE-2026-113864. Their CVSS base scores run from 6.4 up to 8.2, with CVE-2026-113753 the highest at 8.2.
Other notable entries
CVE-2026-114160 is an elevation of privilege flaw involving server-side request forgery, with a CVSS base score of 9.8, the highest score among the entries named in the source material. CVE-2026-113825, which affects the Windows SMB Server network transport driver, is a race-condition remote code execution flaw scored 7.5. Further entries cover the Windows Xbox Live Networking Service (CVE-2026-112967) and the Windows Function Discovery SSDP Provider (CVE-2026-118145).
Open questions
- Why do the critical-vulnerability counts in the sources differ between 60 and 64?
- Will Microsoft or independent researchers publish further detail on the vulnerability already exploited in the wild?