Microsoft patches about 1,090 flaws in November update, one exploited

First reported 10 Nov, 21:47 UTCSource: CyberScoopLast editorial activity 10 Nov, 21:47 UTCWrite a comment ↓

Drone flying over a desert landscape under clear blue skies. — Illustrative photo.Photo by Evelyn Arleth on PexelsMicrosoft logo shown for identification only; no affiliation with or endorsement of WORLDTECH is implied.

According to CyberScoop, Microsoft's November security update addresses roughly 1,090 vulnerabilities spanning Windows, Office, Azure and its other product lines. Only one of them is under active attack, and none had been publicly known before the release.

Scale of the November release

The release formally lists 1,094 CVEs, of which 726 concern Windows and 174 Office. Smaller batches of fixes reach SQL Server, Exchange Server, SharePoint Server, Azure and other products.

The update marks the second straight monthly release whose count surpasses the combined totals of every earlier year. It still trails last month, when a record 1,413 defects were addressed across the company's enterprise offerings.

The exploited Outlook flaw

The zero-day, tracked as CVE-2026-124194, is a spoofing weakness in Outlook. A specially crafted message file causes Outlook to contact a network location controlled by an attacker, without the usual external-content warning.

CISA added the flaw to its Known Exploited Vulnerability (KEV) list shortly after Microsoft published its advisory. Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative, called it a zero-click code execution bug on a high-value target, and said it is more severe than any of the nine Exchange fixes issued this month.

Other severe fixes

Among the gravest corrections is CVE-2026-116928, a Windows Search vulnerability reachable through Exchange Server. A separate Windows LDAP flaw, also rated 9.8, could, Childs said, be quite destructive, particularly on Domain Controllers.

What the pattern suggests

Childs reads the lower count of widely exploited flaws as a sign that attackers are changing their methods, rather than that exploitation is declining. The figures come from Microsoft's own advisory and the Zero Day Initiative's analysis, as CyberScoop reports.

Open questions

How many of the remaining fixed flaws could be exploited once details become public?
Will attackers keep shifting toward targets such as Outlook and Exchange?

Key facts

Microsoft's November security update covers roughly 1,090 vulnerabilities across Windows, Office, Azure and other product lines.

The update formally lists 1,094 CVEs, with 726 for Windows and 174 for Office.

This is the second consecutive monthly release to exceed the totals of all previous years.

Only one flaw is under active attack, and no flaw was publicly known before the release.