Microsoft November 2026 Patch Tuesday: security updates
Published 11/11/2026 16:27
Timeline
2 events over 23 h
- 10/11/2026 17:00ConfirmedMicrosoft Security Update Guide+23 h
- 11/11/2026 16:27Published on WatchtowerPro CISO
In short
Microsoft published fixes for 1,128 vulnerabilities in 307 products on 10/11/2026. One is exploited: CVE-2026-124194. 26 critical. These counts follow the vendor's own feed; the vendor's page has the details of every fix.
Summary
1,128 fixes in 307 products · 1 exploited · 26 critical
| Type of flaw | Fixes |
|---|---|
| Elevation of Privilege | 547 |
| Remote Code Execution | 310 |
| Information Disclosure | 162 |
| Denial of Service | 46 |
| Security Feature Bypass | 28 |
| Spoofing | 23 |
| Tampering | 12 |
| Severity | Fixes |
|---|---|
| Critical | 26 |
| High | 828 |
| Medium | 272 |
| Low | 2 |
Products
| Product family | Fixes | Products | Exploited | Critical |
|---|---|---|---|---|
| Windows | 687 | 217 | – | 10 |
| Microsoft Office | 187 | 7 | 1 | – |
| SQL Server | 53 | 2 | – | 1 |
| Developer tools | 44 | 5 | – | 2 |
| SharePoint | 30 | 1 | – | 3 |
| Azure | 19 | 13 | – | 3 |
| Exchange Server | 9 | 1 | – | – |
| HID Parser Library | 6 | 1 | – | – |
| Microsoft WDAC OLE DB provider for SQL | 5 | 1 | – | – |
| Aspire | 4 | 1 | – | 1 |
| 58 other products | 84 | 58 | – | – |
Counted 10/11/2026 17:00 Amsterdam time from the vendor's own feed. A critical count is CVSS 9.0 or more, or the vendor's or NVD's “critical”; “not scored yet” means neither the vendor nor NVD has scored the fix.
Flaws with their own notice
- Microsoft Outlook: spoofing vulnerability (CVE-2026-124194) exploited in the wild, fix released · Microsoft Outlook - exploited - CVE-2026-124194
- Microsoft SharePoint Server: critical flaws (CVE-2026-109454, CVE-2026-120002) fixed in build 16.0.20326.20278 · Microsoft Office SharePoint - critical - CVE-2026-120002, CVE-2026-109454
- Microsoft SQL Server: heap buffer overflow and command injection (CVE-2026-116945, CVE-2026-116930) fixed in builds listed by Microsoft · Microsoft SQL Server - critical - CVE-2026-116945, CVE-2026-116930, CVE-2026-116929
- Microsoft Exchange Server: remote code execution flaw (CVE-2026-118207) confirmed by Microsoft · Microsoft Exchange Server - CVE-2026-118149, CVE-2026-118150, CVE-2026-118154, CVE-2026-118207, CVE-2026-118153 +4
- Microsoft IIS: critical remote code execution flaw (CVE-2026-70024) fixed in Microsoft's October 2026 updates · Windows Internet Information Services - CVE-2026-119961
Full details
Microsoft's own page for this release lists every fix, the affected versions and the updates.
What to do now
- Install Microsoft's November 2026 security updates on every affected system, following the Microsoft Security Update Guide.
- Start with the flaws the vendor or CISA marks exploited, then the critical ones; the vendor's own page for this release lists every fix: https://msrc.microsoft.com/update-guide/releaseNote/2026-Nov
- Where a flaw has its own Watchtower notice (linked on this page), follow that notice first: it says what is known about it and what to do.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis and all 1 source with their dates. And technology matching: which of your systems run Microsoft, at which version, fixed or not - and what each one needs.