Post -Patch Tuesday Roundup: November 2026

Microsoft

Microsoft has released its November 2026 Patch Tuesday security updates, addressing approximately 1,235 vulnerabilities across the Microsoft ecosystem. This includes an actively exploited Outlook zero-day. The release includes 66 Critical vulnerabilities: 48 RCE, 15 Elevation of Privilege, and three Use-After-Free vulnerabilities affecting Microsoft Edge. This month’s update includes patches for 287 products and components. November's Patch Tuesday comes after a record-breaking 1,411 flaws in the October updates.  

Zero-day vulnerabilities   

CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook, rated Moderate with a CVSSv3 score of 6.5. An attacker could exploit the vulnerability by convincing a user to open a specially crafted Microsoft Office file. Successful exploitation could expose the user’s NTLMv2 hash, which could then be used to impersonate the user in subsequent attacks. 

Microsoft has confirmed that the vulnerability was exploited in the wild as a zero-day. The advisory also credits a security researcher who used Anthropic’s Claude LLM during the discovery, although the specific Claude version was not disclosed. 

Critical  

CVE-2026-118207  is a Critical Remote Code Execution (RCE) vulnerability affecting Microsoft Exchange Server, with a CVSSv3 score of 8.8. An authenticated attacker could exploit the vulnerability by sending malformed input to the Exchange Server, potentially allowing arbitrary code execution over the network. Microsoft has assessed exploitation as “Exploitation More Likely.” 

CVE-2026-118146  is a Critical Remote Code Execution (RCE) vulnerability affecting Windows Active Directory Domain Services, with a CVSSv3 score of 8.8. An authenticated attacker could exploit an authorisation flaw to execute arbitrary code remotely on an affected system. Microsoft has assessed the vulnerability as “Exploitation More Likely.” 

CVE-2026-119952 - is an RCE vulnerability affecting Windows Schannel. It received a CVSSv3 score of 8.1 and is rated as critical. An unauthenticated attacker could exploit an observable timing discrepancy in Windows Schannel to execute code over a network. Successful exploitation would allow an attacker to execute arbitrary code on the affected system. It was assessed as “Exploitation More Likely.” 

CVE-2026-113862 is a Remote Code Execution (RCE) vulnerability affecting Windows Network Address Translation (NAT). It has a CVSSv3 score of 8.1 and is rated High. The vulnerability is caused by a use-after-free condition and could allow an unauthenticated attacker to execute code remotely over a network on an affected Windows system. It was assessed as “Exploitation More Likely.” 

Important 

CVE-2026-120002  is an Elevation of Privilege vulnerability affecting Microsoft SharePoint Server. It has a CVSSv3 score of 9.9 and is rated Important. An authenticated attacker could exploit an incorrect authorization flaw in Microsoft Office SharePoint over a network to gain elevated privileges. Microsoft has assessed exploitation as “Less Likely.” 

CVE-2026-121663  is a high-severity security feature bypass vulnerability affecting Microsoft Visual Studio Code, with a CVSS score of 8.8. The vulnerability could allow an unauthenticated attacker to bypass a security control over the network, although successful exploitation requires user interaction. Organisations using affected versions should upgrade to Visual Studio Code 1.145.3 or later. At present, there is no indication that the vulnerability is being actively exploited. 

CVE-2026-121662 is another High-severity command injection/security feature bypass vulnerability in Microsoft Visual Studio Code, with a CVSS v3.1 score of 8.6. Affecting Versions earlier than 1.145.3.  

CVE-2026-105501, CVE-2026-119892, and CVE-2026-119903 are high-severity elevation-of-privilege vulnerabilities affecting Microsoft Windows Installer, each with a CVSS score of 7.8. The vulnerabilities relate to improper access control or authorization and could allow an authenticated attacker with existing local access to elevate their privileges on an affected system.  

Recent updates from other Vendors  

Cisco released security updates for several products, addressing critical vulnerabilities in Catalyst SD-WAN Controller, Secure Email Gateway, and Meraki.

Ivanti has released security updates addressing two vulnerabilities affecting Connect Secure (ICS) remote access gateways. The vulnerabilities have reportedly been chained together and exploited as zero-days in attacks since at least October. 

SAP has published its November 2026 security updates, addressing a range of vulnerabilities, including four rated at the maximum severity level. 

SonicWall has released security updates addressing seven vulnerabilities affecting SonicOS firewalls, including an SSL-VPN authentication bypass vulnerability that has been exploited in attacks. 

Linux distributions released security updates to fix an authentication bypass flaw involving OpenSSH and musl, dubbed "*sshole". 

Check Point released security updates addressing multiple vulnerabilities. Customers are advised to apply the latest hotfixes and patches.  

Fortinet released its November security updates, addressing critical and high-severity vulnerabilities across several products, including FortiOS, FortiSASE, FortiManager, FortiAnalyzer and other Fortinet products. 

Citrix released security updates for CVE-2026-111497, a security vulnerability affecting Unicon eLux Scout components. The vulnerability is caused by an issue in the Google Brotli decoder and could potentially result in memory corruption, information disclosure, denial of service, or code execution. Customers are advised to apply the relevant security updates as soon as possible 

Barracuda Networks released security updates for two vulnerabilities (CVE-2026-116606 and CVE-2026-111560).  Exploitation of the vulnerabilities in combination could allow an attacker to bypass authorization controls and obtain root access. Barracuda has also updated the advisory to confirm that it has observed exploitation affecting a small number of organizations. Affected products includes Email Security Gateway (ESG), Load Balancer ADC, Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF) and Web Security Gateway.  

As always, users are strongly encouraged to apply the latest security updates as soon as they become available to help protect their systems against known vulnerabilities.