Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
Microsoft fixed 1,094 vulnerabilities, including an Outlook zero-day and two critical zero-click flaws that could enable remote code execution.
- On Tuesday, Microsoft released its monthly Patch Tuesday updates, addressing 1,094 vulnerabilities including an actively exploited Outlook spoofing vulnerability tracked as CVE-2026-124194 with a 6.5 CVSS rating.
- Back-to-Back months of more than 1,000 CVEs signal a permanent shift in vulnerability volume; Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative, attributed this to automated bug-hunting permanently resetting patch volume.
- Two critical zero-click threats, CVE-2026-116928 and CVE-2026-119958, carry 9.8 CVSS ratings and affect the Microsoft Windows Search Component and Lightweight Directory Access Protocol, requiring no user interaction to exploit.
- Childs identified 30 additional vulnerabilities posing a "wormable risk," while a critical heap-overflow flaw in the Windows Xbox Live Networking Service, CVE-2026-112967, carries a 9.8 CVSS rating and allows remote code execution.
- Defenders should prioritize patching Exchange and Domain Controllers to stop zero-click compromise, then ring-fence exposed network services like DNS and DHCP to prevent wormable spread across systems.
18 Articles
18 Articles
Microsoft's November update eliminates more than 1,000 vulnerabilities. A vulnerability in Outlook already exploits attackers. Windows 11 also gets new features.
Use Outlook? Hackers can take over your PC with a single email, you must update immediately
Cybercrooks could take control of your PC with a single email sent to Outlook. Worse still, the vulnerability that enables this attack is known to hackers worldwide. This is known as a "zero-day flaw" because there are zero days before the secret is out, meaning it's a race against time to update your device with the fix before cybercriminals attack you.Without the fix, mistakenly opening a malicious email is enough to let hackers wrest control …
Outlook security flaw is already being exploited by hackers. Windows login credentials could be at risk. Here's how to protect yourself.
Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability.
Coverage Details
Bias Distribution
- 50% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
