Microsoft Releases November 2026 Security Updates
Scheduled security updates for Microsoft products address 1,235 vulnerabilities, including 1 zero-day vulnerability
Summary
Scheduled security updates for Microsoft products address 1,235 vulnerabilities, including 1 zero-day vulnerability
Affected platforms
The following platforms are known to be affected:
The following platforms are also known to be affected:
Multiple other Microsoft platforms. Please see Microsoft's November 2026 Security Updates guide for full details.
Threat details
One zero-day vulnerability identified
Microsoft states that exploitation of CVE-2026-124194 has been reported and the US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-124194 to the Known Exploited Vulnerabilities (KEV) Catalog.
The NHS England National CSOC assess that future exploitation is highly likely.
Introduction
Microsoft has released security updates to address 1,235 vulnerabilities in Microsoft products, including a zero-day vulnerability CVE-2026-124194.
- CVE-2026-124194 - "Microsoft Outlook Spoofing Vulnerability" - CVSSv3.1 score of 6.1. This vulnerability is exploited as a zero-day.
- CVE-2026-120002 - "Incorrect authorisation in Microsoft Office SharePoint" vulnerability - CVSSv3.1 score of 9.9
- CVE-2026-119958 - "Out-of-bounds write in Windows LDAP" vulnerability - CVSSv3.1 score of 9.8
- CVE-2026-118146 –"Windows Active Directory Domain Services Remote Code Execution" Vulnerability - CVSSv3.1 score of 8.8
- CVE-2026-119952 - "Windows Schannel RCE" vulnerability - CVSSv3.1 score of 8.1
Remediation advice
Affected organisations are encouraged to review Microsoft's November 2026 Security Updates and apply the relevant updates as soon as possible.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 11 November 2026 3:34 pm