Microsoft lists 1,094 flaws in the November security updates

Microsoft published the November 2026 Security Updates on November 10, listing 1,094 flaws. Sixty-three are rated critical. One is already exploited.

The November 10 release adds 1,094 flaws. Microsoft's Security Update Guide titles the document November 2026 Security Updates, with a current release time of 8:00 a.m. UTC on November 10, which is 4:00 a.m. Atlantic time. The 1,094 count is the set of CVEs whose first revision date is November 10, not every entry already sitting in the November document. Of that set, Microsoft is the assigning authority on 1,093. VulDB assigned the other one.

The severity split is 63 critical, 1,029 important, and 2 moderate. Those three groups add up to the 1,094.

Elevation of privilege is the largest class. The guide classifies 535 as elevation of privilege and 296 as remote code execution. Another 156 are information disclosure, 46 denial of service, 27 security feature bypass, 22 spoofing, and 11 tampering. One flaw has no impact class in the guide. Those classes also add up to 1,094.

Windows and Office account for most of the set. The largest product groups are Windows, with 744 flaws, and Microsoft Office, with 204. SQL Server has 54, developer tools 49, and Azure 18. Server software and a catch-all other group have 9 each. Open source software has 2. Those are the largest groups in the guide's family tally, not a claim that every flaw sits in only one of them.

Four critical flaws are scored 9.8. The guide lists 63 critical flaws. Four of them carry a base score of 9.8. CVE-2026-112967 is remote code execution in the Windows Xbox Live Networking Service. CVE-2026-116928 is remote code execution in Windows Search. CVE-2026-119958 is remote code execution in Windows LDAP. CVE-2026-119990 is an elevation of privilege flaw in Azure OpenAI. None of those four is marked exploited, and none is marked publicly disclosed.

Other critical flaws in the same release include remote code execution in Exchange Server, Active Directory Domain Services, Outlook, Word, Excel, PowerPoint, and the Raw Image Extension. The guide scores those examples at 8.8. The critical list is longer than the examples named here.

One flaw is already exploited. CVE-2026-124194 is an Outlook spoofing vulnerability. Microsoft rates it moderate, with a base score of 6.5, and marks it exploited. It is not marked publicly disclosed. No other flaw in the November 10 set is marked publicly disclosed.

Microsoft's page for that flaw says an attacker can send a crafted message file and convince a user to open it in an affected version of Outlook. The preview pane is not an attack vector. Customers apply the November updates through the usual Windows and Office servicing channels.