Microsoft’s November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194)

CVE-2026-124194 | Microsoft Outlook spoofing vulnerability

CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook. It received a CVSSv3 score of 6.5 and is rated moderate. An attacker could exploit this vulnerability by convincing a target to open a crafted Microsoft Office file. Successful exploitation would allow an attacker to obtain the target’s valid NTLMv2 hash, which can then be used to impersonate that user in follow-on attacks.

According to Microsoft, this vulnerability was exploited in the wild as a zero-day. Additionally, the advisory credits this discovery to a security researcher that used Claude, the large language model (LLM) from Anthropic, though no specific version of Claude was noted in the advisory.

CVE-2026-118146 | Windows Active Directory Domain Services remote code execution vulnerability

CVE-2026-118146 is an RCE vulnerability affecting Windows Active Directory Domain Services. It received a CVSSv3 score of 8.8 and is rated as critical. An authenticated attacker could exploit an incorrect authorization in Active Directory Domain Services to execute code over a network. Successful exploitation would allow an attacker to execute arbitrary code on the affected system. It was assessed as “Exploitation More Likely.”

CVE-2026-120002 | Microsoft SharePoint Server elevation of privilege vulnerability

CVE-2026-120002 is an EoP vulnerability affecting Microsoft SharePoint Server. It received a CVSSv3 score of 9.9 and is rated as important. An authenticated attacker could exploit an incorrect authorization in Microsoft Office SharePoint to elevate privileges over a network. Successful exploitation would allow an attacker to gain elevated privileges. It was assessed as “Exploitation Less Likely.”

CVE-2026-118207 | Microsoft Exchange Server remote code execution vulnerability

CVE-2026-118207 is an RCE vulnerability affecting Microsoft Exchange Server. It received a CVSSv3 score of 8.8 and is rated as critical. An authenticated attacker could send malformed input to Microsoft Exchange Server, causing code to execute over a network. Successful exploitation would allow an attacker to execute arbitrary code on the affected system. It was assessed as “Exploitation More Likely.”

CVE-2026-119952 | Windows Schannel remote code execution vulnerability

CVE-2026-119952 is an RCE vulnerability affecting Windows Schannel. It received a CVSSv3 score of 8.1 and is rated as critical. An unauthenticated attacker could exploit an observable timing discrepancy in Windows Schannel to execute code over a network. Successful exploitation would allow an attacker to execute arbitrary code on the affected system. It was assessed as “Exploitation More Likely.”