Microsoft fixes 1,093 flaws, including exploited Outlook zero-day

Microsoft’s November 2026 Patch Tuesday, issued on 10 November 2026, addresses 1,093 vulnerabilities across Windows, Office, Azure and server products. The release includes one exploited zero-day and flags 42 additional bugs as more likely to be exploited. The most severe issue is a cloud flaw rated CVSS 10.0 (CVE-2026-109469), with other high‑impact bugs mainly enabling remote code execution without a login.

The outlook is that these fixes are a priority, particularly for internet-facing and identity systems, and Microsoft urges rapid deployment of the latest updates.

The exploited zero-day is CVE-2026-124194, a Microsoft Outlook spoofing flaw described by Microsoft as allowing an unauthorised action without a warning to the user, and it has been added to CISA’s Known Exploited Vulnerabilities catalog with a federal deadline of 24 November. Additional notable CVEs in this release include CVE-2026-120002 (SharePoint Server) and CVE-2026-109467 (Azure DevOps Server), both rated 9.9, alongside multiple 9.8 and 9.9‑rated flaws across Windows network services and server products.

Microsoft notes that several of the critical network service bugs—Kerberos, LDAP, DNS, DHCP Server and iSCSI—are automatable and can be exploited without authentication. The guidance lists a progression for patching: start with Outlook, then domain controllers and DNS/DHCP/iSCSI servers, followed by SharePoint, Azure DevOps Server and SQL Server; the full list is available in the Microsoft Security Update Guide.

Affected products span Windows client and server editions, Microsoft 365 Apps, Office LTSC variants, SharePoint Server Subscription Edition and multiple SQL Server versions.