Microsoft November 2026 Patch Tuesday: 1,093 CVEs, One Zero-Day Being Exploited Right Now, and a Patch Order Your Business Needs to Follow
Microsoft released patches for 1,093 vulnerabilities on the 10th of November 2026. One of them is already being exploited. Right now. Against businesses like yours.
That is not vendor fear-mongering. That is CISA, the United States Cybersecurity and Infrastructure Security Agency, adding CVE-2026-124194 to its Known Exploited Vulnerabilities catalogue on the same day Microsoft issued the fix, with a binding remediation deadline of the 24th of November 2026.
If you run Windows, Microsoft 365, Office, or Exchange, this month’s Patch Tuesday is not something you can defer until your IT provider gets around to it. This one requires deliberate, prioritised action. This article gives you the full picture: what was patched, why the critical ones matter for a UK small business, and the exact order in which to fix things.
The Numbers, Without the Spin
Security vendors count CVEs differently depending on methodology. Tenable, whose analysis cross-references Microsoft’s own Security Update Guide directly, counts 1,093 CVEs patched in Microsoft’s own products. CrowdStrike’s count of 1,252 includes Chromium and third-party components bundled into the release. For the purposes of this article, the conservative Microsoft-product-only figure of 1,093 is used.
Breakdown by severity: 63 Critical, 1,029 Important, 1 Moderate.
Breakdown by vulnerability type: Elevation of Privilege accounts for 535 (nearly half the total), Remote Code Execution for 296, Information Disclosure for 156, Denial of Service for 46, Security Feature Bypass for 27, Spoofing for 22, and Tampering for 11.
Of the 63 Critical flaws, 48 are Remote Code Execution vulnerabilities and 15 are Elevation of Privilege.
One vulnerability was confirmed as actively exploited in the wild at the time of release. Zero vulnerabilities were publicly disclosed before the patch was issued, which is a minor silver lining in an otherwise brutal month.
Windows alone accounts for over 1,100 vulnerabilities patched this month, according to Rapid7’s analysis. The products with the highest CVE counts are Word (65), Excel (64), SQL Server (53), and Windows Advanced Rasterization Platform (37).
This volume is extraordinary. It is also largely irrelevant to your immediate decision-making. What matters is which vulnerabilities an attacker would actually use against your business, and in what order. That is what the rest of this article covers.
The Zero-Day Being Exploited Right Now: CVE-2026-124194
What it is: Microsoft Outlook spoofing vulnerability. CVSS score 6.5, rated Moderate by Microsoft. Do not let that rating fool you into deprioritising it. It is in CISA’s KEV catalogue, meaning it is confirmed exploited in the wild.
What it does: An attacker sends a target a specially crafted Office file. When the victim opens it, Outlook silently initiates an outbound connection to an attacker-controlled server, without displaying any warning or external-content prompt. That connection hands over the victim’s NTLMv2 hash, the cryptographic representation of their Windows credentials.
The attacker now has two options. They can attempt to crack the hash offline, using commodity GPU cracking tools that have become dramatically cheaper over the past three years. Or they can relay the hash in real time, using it to authenticate as the victim against other services on your network, particularly those that do not enforce SMB signing or Extended Protection for Authentication.
What is not an attack vector: The Preview Pane. Microsoft’s own FAQ for this CVE confirms the Preview Pane does not trigger the vulnerability. The user must open the file. That distinction matters, but it offers cold comfort given how readily staff open email attachments.
Who is affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, in both 32-bit and 64-bit versions.
The CISA angle: CISA added CVE-2026-124194 to the KEV catalogue on the 10th of November 2026 and set a remediation due date of the 24th of November 2026 for US federal agencies. The KEV catalogue is the global gold standard for confirmed exploitation. When CISA sets a two-week deadline, it is because the exploitation is real and active, not theoretical.
Interim compensating control: While you are arranging patching, consider asking your IT provider to block outbound SMB traffic from user workstations and to review NTLM relay protections. Rescana’s analysis notes this as a reasonable compensating control, though it is not an official Microsoft workaround and is not a substitute for patching.
How to fix it: This is not delivered via Windows Update. It arrives through Microsoft 365 Apps updates or Office LTSC security updates. If your machines update Microsoft 365 Apps automatically, they may already be patched. Check. Do not assume.
The Four Flaws That Could Destroy a Small Business Network
Beyond the confirmed zero-day, four additional vulnerabilities stand out as requiring immediate attention from any UK small business running standard Microsoft infrastructure. None are confirmed exploited yet. All are assessed by Microsoft as “Exploitation More Likely” or carry characteristics that make them particularly dangerous.
CVE-2026-116928: Windows Search Remote Code Execution (The Zero-Click Exchange Attack)
CVSS: 9.8. Critical. Unauthenticated.
This is the most technically alarming vulnerability in this month’s release for businesses running their own Exchange server.
An unauthenticated attacker sends an email with a crafted attachment to your Exchange Server. They do not need to compromise an account first. They do not need to know anyone’s email address in particular. Exchange automatically processes incoming email attachments through the Windows Search indexing component. That indexing process triggers the out-of-bounds write (CWE-787) that gives the attacker code execution on the Exchange Server.
The recipient never needs to open the email. The recipient never needs to open the attachment. The attack fires the moment Exchange touches the message.
Rapid7’s analysis describes this accurately as a zero-click vulnerability for internet-facing Exchange servers.
Critically: the patch is not an Exchange update. It is delivered through the Windows OS cumulative updates. This matters because organisations that think they have patched Exchange may not have patched the underlying Windows component that is actually vulnerable. If your Exchange server’s underlying Windows OS is not patched this month, you remain exposed regardless of what your Exchange version says. Confirm the Windows cumulative update has been applied to your Exchange server’s operating system.
Affected Windows builds include: Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; Windows Server 2016, 2019, 2022, and 2025, including Server Core editions.
CVE-2026-119958: Windows LDAP Remote Code Execution (The Domain Controller Killer)
CVSS: 9.8. Critical. Unauthenticated.
LDAP stands for Lightweight Directory Access Protocol. It is the protocol your Domain Controller uses to answer authentication queries from every device on your network. Every Domain Controller exposes LDAP on TCP port 389 and secure LDAP on TCP port 636 by design. You cannot disable it without breaking your Active Directory environment.
This vulnerability allows an unauthenticated attacker to send specially crafted LDAP calls that trigger an out-of-bounds write, again CWE-787, resulting in code execution inside the LDAP service on your Domain Controller.
Code execution inside the LDAP service on a Domain Controller means the attacker is operating inside the trust boundary of your entire directory. From there, credential extraction, Active Directory replication abuse, and lateral movement across every device in your network are all straightforward follow-on steps. This is a network-wide catastrophe waiting to happen.
CrowdStrike’s analysis is blunt: every Domain Controller exposes LDAP by design and cannot disable it. If you have a Domain Controller and it is not patched, it is exposed.
Delivered via Windows OS cumulative updates. Same delivery mechanism as CVE-2026-116928. Apply this month’s Windows cumulative updates to your Domain Controllers.
CVE-2026-119952: Windows Schannel Remote Code Execution (The TLS Stack Flaw)
CVSS: 8.1 High (Microsoft labels it Critical). Pre-authentication. No user interaction required.
Schannel is Microsoft’s implementation of TLS, the encryption protocol that underpins HTTPS, secure email, and virtually every other encrypted connection a Windows server makes. Because Schannel is embedded in the operating system itself, it touches every internet-facing Windows service.
This vulnerability involves an observable timing discrepancy that allows an unauthenticated attacker to send crafted packets and achieve code execution. The CVSS score reflects that specific protocol configurations are required for exploitation, reducing the likelihood of indiscriminate mass exploitation. Microsoft nonetheless assesses it as “Exploitation More Likely” and considers reliable exploit code feasible.
Rapid7 notes that the execution context depends on which service is running the vulnerable Schannel instance. In some cases, that means SYSTEM-level privileges.
For a UK small business with any internet-facing Windows services, including VPN endpoints, web servers, or remote access solutions, this is a patch-now vulnerability.
Delivered via Windows OS cumulative updates.
CVE-2026-118207: Exchange Server Remote Code Execution (The Authenticated Exchange Attack)
CVSS: 8.8. Critical. Authenticated.
Unlike CVE-2026-116928, this Exchange vulnerability requires an authenticated attacker. That means they need a valid mailbox credential first. Given the prevalence of credential theft through phishing, that bar is lower than it sounds.
An authenticated attacker sends malformed input to Exchange, triggering network-level code execution. Microsoft assesses this as “Exploitation More Likely.” Exchange often exposes Outlook Web Access, ActiveSync, and Autodiscover to the internet, making it reachable by an attacker who has obtained any compromised mailbox credential.
This one is delivered via Exchange Server security updates, distinct from the Windows OS updates. Confirm your Exchange team or MSP has applied the Exchange-specific patch, not just the Windows cumulative update.
Only Exchange Subscription Edition is currently supported by Microsoft. If your business is running any older Exchange version, it is beyond end of support and will not receive this patch. That is a conversation you need to have with your IT provider this week.
Other Critical Vulnerabilities Worth Knowing About
The four above are the priority targets for UK SMBs. These deserve a mention because they affect infrastructure that many small businesses run.
Active Directory Domain Services (CVE-2026-118146, CVSS 8.8): An authenticated low-privilege user exploits incorrect authorisation to execute code on a Domain Controller. Any employee account is sufficient. Combined with CVE-2026-119958, this month’s DC patch priority is as high as it gets.
SharePoint Server (CVE-2026-120002, CVSS 9.9): Rated Important rather than Critical by Microsoft, but with a CVSS of 9.9, this is an elevation of privilege vulnerability where an authenticated SharePoint user gains significantly elevated permissions. If you run on-premises SharePoint, patch it.
Remote Desktop Client and Gateway (Multiple CVEs): Multiple Remote Code Execution vulnerabilities affect the Remote Desktop Client. CVE-2026-119390, CVE-2026-119858, CVE-2026-119934, and CVE-2026-95964 are all Important-rated RCE flaws. The Remote Desktop Gateway Service has two RCE vulnerabilities: CVE-2026-69327 and CVE-2026-69565. If your business uses RDP or RD Gateway for remote access, these matter.
Print Spooler (CVE-2026-113752): A Critical Remote Code Execution vulnerability in Print Spooler, exploitable by an unauthenticated attacker on an adjacent network, running as SYSTEM. Print Spooler is enabled by default on nearly every Windows installation. This is delivered via Windows cumulative updates.
Office Preview Pane RCEs (Multiple, including CVE-2026-110043, CVE-2026-110068, CVE-2026-111309): These are Critical-rated Outlook Remote Code Execution vulnerabilities, distinct from the zero-day. These three fire from the Preview Pane, without the user opening the file. CrowdStrike notes this is the third consecutive month in which Preview-Pane-triggered exploitation has been a dominant attack pattern. Patch Office.
Microsoft Defender (CVE-2026-122194, CVSS 8.8): A Critical RCE in Microsoft Defender. If your business uses Defender as its endpoint security tool, this is a direct attack against your security tooling. The irony of an unpatched antivirus becoming an attack vector is not lost on anyone who has worked in this industry long enough.
Lifecycle Changes: Things That Stop Working on the 11th of November 2026
Effective the 11th of November 2026, the following reached end of support:
- .NET 8 (Long-Term Support)
- .NET 9
- PowerShell 7.4 (Long-Term Support)
- PowerShell 7.5
- Windows 11 23H2, Enterprise, Education, and IoT editions
If your business runs any of these, they will no longer receive security patches. Applications built on .NET 8 or .NET 9 are now running on an unsupported runtime. Windows 11 23H2 devices in your fleet are now unpatched by design. This is not a future problem. It became a present problem yesterday.
Ask your IT provider which of these apply to your environment. If the answer is any of them, you need a remediation timeline.
The Patch Priority Order for UK Small Businesses
Microsoft OS patches are, in the vast majority of cases, all-or-nothing cumulative updates. You apply this month’s cumulative update and you get all the Windows fixes. You cannot cherry-pick individual Windows CVEs. What you can do is prioritise which systems get patched first, and ensure the non-Windows components (Office, Exchange application layer) are also addressed.
Here is the order:
1. Office / Microsoft 365 Apps: Today. CVE-2026-124194 is confirmed exploited in the wild. CISA’s deadline is the 24th of November 2026. This patch is not delivered via Windows Update. It comes through Microsoft 365 Apps update channels or Office LTSC security updates. Verify it has been applied. Do not assume automatic updates have handled it.
2. Domain Controllers: Today, before anything else on the Windows side. CVE-2026-119958 (LDAP RCE, CVSS 9.8) is an unauthenticated attack directly targeting your Domain Controllers. CVE-2026-118146 (AD DS RCE, CVSS 8.8) requires only a low-privilege account. Your Domain Controller is the master key to your entire network. Patch it first. Apply this month’s Windows cumulative update.
3. Exchange Servers: Today. Two separate attack paths this month: CVE-2026-116928 via Windows Search (apply Windows cumulative update to the server OS) and CVE-2026-118207 via Exchange itself (apply Exchange Server security update). Both are needed. Confirm both with your IT provider or MSP.
4. All Other Windows Servers: This Week. Schannel (CVE-2026-119952) affects every internet-facing Windows service. Apply this month’s cumulative update to all Windows servers, prioritising those with internet-facing roles: VPN endpoints, web servers, remote access infrastructure.
5. All Windows Workstations: This Week. The same cumulative update that patches the server vulnerabilities covers workstations. Windows 10 and Windows 11 devices all need this month’s update. If automatic updates are configured and working, verify they have actually applied. Do not assume.
6. If You Are Running Windows 11 23H2: Upgrade Now. Windows 11 23H2 reached end of servicing on the 11th of November 2026 for Enterprise, Education, and IoT editions. It will not receive future security patches. Move to 24H2 or later.
A Note on Counting Vendors and CVE Numbers
You will see different numbers quoted across different security vendors this month: 1,093, 1,092, 1,252. The variance is methodological. CrowdStrike’s higher count includes Chromium and third-party components bundled into Microsoft products. Tenable and Rapid7 count Microsoft’s own-product CVEs only. None of these organisations are wrong; they are counting different things. The number to focus on is not the total count. It is the specific vulnerabilities that affect your infrastructure.
How to Turn This Into a Competitive Advantage
Patching is not just about avoiding disaster. It is increasingly a commercial requirement.
If your business supplies goods or services to larger organisations, the NHS, local government, or any regulated sector, your security posture is under growing scrutiny through procurement questionnaires and supply chain assessments. Demonstrating that you apply critical patches within the CISA-equivalent timeframe of 14 days is a verifiable, concrete answer to those questions.
If you hold Cyber Essentials certification, timely patching is a core requirement. Applying this month’s updates within 14 days of release is not just good practice; it is part of maintaining that certification’s integrity. Certificate-on-the-wall compliance theatre will not survive an audit if your Domain Controllers are running unpatched for six weeks.
Businesses that patch systematically and quickly reduce dwell time. Dwell time is the period between an attacker gaining access and being detected. Every day you delay patching is a day during which an attacker who finds a way into your network can operate undetected using a known vulnerability that you chose not to fix.
Making the Business Case to Your Board or Senior Team
Three arguments that will land if you need budget or sign-off for emergency patching work:
The regulator has set a deadline. CISA’s binding remediation date of the 24th of November 2026 for CVE-2026-124194 is the global signal for urgency. The ICO takes a dim view of breaches resulting from known, patchable vulnerabilities. If this Outlook zero-day is used to steal credentials that lead to a data breach, and you had not applied a patch that was available from the 10th of November 2026, that is a difficult conversation with the ICO.
The attack cost is asymmetric. Applying Windows Update to your servers costs your IT provider a few hours. Recovering from a Domain Controller compromise, the scenario CVE-2026-119958 enables, costs days or weeks of downtime, forensic investigation, potential regulatory notification, and reputational damage. The maths is not complicated.
Your MSP may not have done it yet. Ask. Do not assume that managed service agreements automatically include emergency patching within 14 days. Some do. Many do not. Get a written confirmation of when these updates will be applied, and if the answer is “next scheduled maintenance window in three weeks,” push back.
What to Do This Week
Step 1: Confirm Microsoft 365 Apps or Office has been updated on all devices. Check via Settings, then Office Account, then Update Options, then Update Now. Do this today.
Step 2: Ask your IT provider or MSP to confirm that this month’s Windows cumulative update has been applied to your Domain Controllers and Exchange servers. Get a written response.
Step 3: Ask specifically whether the Exchange application-layer update for CVE-2026-118207 has been applied, separate from the Windows OS update. These are two different patches.
Step 4: Confirm that all Windows workstations are running this month’s cumulative update. Check via Settings, then Windows Update.
Step 5: If you have Windows 11 23H2 devices in your fleet, raise this with your IT provider. They are now unpatched by design and need upgrading.
Step 6: If your IT provider cannot confirm the above within 24 hours, that is information worth having.
You can stay up to date with every CVE and KEV entry every morning with the Daily CVE Update, and get broader breaking cyber news with Threat Analysis every afternoon, Monday to Friday, wherever you get your podcasts. And do not forget the main show every Monday lunchtime. Just search for The Small Business Cyber Security Guy.