Overview
- Microsoft published its November Patch Tuesday updates on Tuesday, Nov. 10, closing 1,093 vulnerabilities across Windows, Office, Exchange, SQL Server, Hyper‑V, .NET and other products while Edge received separate Chromium fixes earlier in the month.
- Researchers and Microsoft say Outlook vulnerability CVE-2026-124194 is being actively exploited by attackers who send a crafted Office file that makes Outlook contact an attacker server and can leak NTLMv2 authentication data.
- A critical Windows Search bug (CVE-2026-116928, CVSS 9.8) allows unauthenticated remote code execution when Exchange Server automatically indexes a malicious email attachment so victims do not need to open or interact with the message.
- Microsoft also fixed nine Exchange flaws including CVE-2026-122194, an RCE Microsoft rates as having 'exploitation more likely,' and security teams are telling administrators to enable Windows Update and prioritize those high‑risk CVEs first.
- The unusually large monthly patch volume is becoming routine, which raises workload and prioritization challenges for IT teams; Microsoft extended consumer Windows 10 ESU to Oct. 12, 2027, and the next patch cycle is scheduled for Dec. 8.