Adobe and Microsoft November updates fix over 1,200 flaws

Adobe’s November 2026 updates address nine bulletins across Connect, Experience Manager, Audition, After Effects, Dimension, Photoshop, Media Encoder, Premiere and Content Credentials SDK, totalling 110 CVEs. The standout is APSB26-191 for Adobe Connect, with 24 CVEs, 18 of which are Critical and a top CVSS of 10.0; Adobe lists this as Priority 2 and notes no known exploits in the wild.

Experience Manager’s APSB26-189 covers 14 CVEs, including four Critical bugs with CVSS scores up to 9.9, two of which are incorrect-authorization issues and two are code injections, all enabling arbitrary code execution over the network with no user interaction and requiring only a low-privileged account. The remaining patched Adobe products are Deployment Priority 3, and Adobe states none of the other fixes are publicly known or under active attack at the time of release. Dustin Childs notes the patches should be prioritised for network-facing services such as DNS, LDAP and Exchange.

Microsoft’s November 2026 update cycle is extensive, with child patches broadly spanning Windows, Office, .NET, Azure and more. Childs cites around 1,090 new CVEs released that month, with affected products including Windows components, Office suites, Exchange Server, Azure services, and Xbox. Notably, there is only one bug under active attack in this release, and none publicly known at the time of publication, though exploitation in the wild remains a concern.

The most significant Microsoft flaws highlighted are: CVE-2026-124194 (Microsoft Outlook Spoofing, CVSS 6.5; exploited in some environments), CVE-2026-116928 (Windows Search Remote Code Execution, CVSS 9.8; high-value, no user interaction), CVE-2026-119958 (Windows LDAP RCE, CVSS not explicitly stated here but dangerous), CVE-2026-119952 (Windows Schannel RCE, CVSS high,

“Exploitation More Likely”), CVE-2026-119990 (Azure OpenAI Elevation of Privilege; customer action required, limited guidance), and CVE-2026-112967 (Windows Xbox Live Networking Service RCE, CVSS 9.8). Childs also highlights that about 30 of November’s CVEs fit his wormable definition, spread across Message Queuing, DNS, Exchange, LDAP, and various Exchange/Office components, with multiple RCEs reachable over the network without authentication or user interaction. The full Microsoft CVE list is provided in the article, including additional high-risk items across the suite.