Source: Zecurit (analysis of Microsoft Security Response Center release notes)
Microsoft’s November 2026 Patch Tuesday, released on Tuesday 10 November 2026, addresses more than 1,090 Microsoft CVEs. Trackers count the release at 1,093 to 1,094 CVEs depending on how non-Microsoft items are handled. It follows October’s record release of roughly 1,413 to 1,415 CVEs, keeping the monthly workload far above anything seen before 2026.
The one flaw attackers are already using
The headline item is the only vulnerability in the release flagged with exploitation detected: CVE-2026-124194, a Microsoft Outlook spoofing vulnerability. Spoofing flaws let an attacker make content or an identity appear to come from a trusted source, which makes them directly useful in phishing and business email compromise campaigns. Outlook is installed on most business endpoints and is the entry point for much of the email an organisation receives, and it has now featured prominently two months running after October’s five Critical Outlook remote code execution flaws. Microsoft’s release notes had not described the attack in detail at the time of analysis, so the Security Update Guide entry should be checked for the affected Office builds and the fixing update.
Where the volume sits
Windows accounts for 726 CVEs, about two thirds of the release, delivered as a single cumulative update per supported version. Office follows with 174 CVEs across seven distinct updates, with Office 2016 handled separately. SQL Server has 59, Developer Tools 53, SharePoint Server 27 and Exchange Server 9. Developer Tools carries the highest number of distinct updates, 28, which makes it the easiest family to miss in a patch plan built around the operating system. One third-party note from the same window: Google patched an exploited Chrome zero-day, CVE-2026-125350, the day before Patch Tuesday, so Windows endpoints should be confirmed on Chrome 157.0.8103.50 or later.
Support deadlines reached on 10 November
Several support milestones coincide with this release. .NET 8 and .NET 9 reach end of support on 10 November 2026, along with PowerShell 7.4 and Windows 11 Enterprise and Education 23H2. Anything left on those runtimes or builds stops receiving security fixes from the December release onwards. That means inventorying servers, build agents and line-of-business applications that still target .NET 8 or .NET 9 and planning the move to .NET 10, plus confirming managed Windows 11 devices are on a supported feature update.
What to do this week
Fast-track the Office and Outlook updates to every mail client first, confirm Chrome is current on every Windows endpoint, and check the known-issues list before promoting updates past your pilot ring. For organisations without a mature patch process, a release of this size is exactly where gaps turn into incidents. If your team needs help building a patch management process that keeps up with releases of this scale, or an independent review of your Windows, Office and Exchange exposure, contact Excello Digital for practical security advice.