Overview
Microsoft's Patch Tuesday release of November 10, 2026 addresses 1094 vulnerabilities. Of these, 63 are rated critical, 1029 Important (high) and 2 Moderate; none is rated low. Elevation of privilege is the most common impact type with 534 entries, followed by remote code execution with 296 and information disclosure with 156. Chromium-based Edge vulnerabilities are not included in these counts.
What stands out
Microsoft lists one vulnerability as exploited: CVE-2026-124194, a spoofing vulnerability in Microsoft Office Outlook with a CVSS score of 6.5, rated Moderate. Microsoft lists no publicly disclosed vulnerabilities this month.
Among the 63 critical vulnerabilities, the highest-scored listed entries carry a CVSS score of 9.8: remote code execution flaws in the Windows Xbox Live Networking Service (CVE-2026-112967), the Windows Search component (CVE-2026-116928) and Windows LDAP (CVE-2026-119958), and an elevation of privilege flaw in Azure OpenAI (CVE-2026-119990). Microsoft Office accounts for many of the critical entries. Microsoft Office Word has the most fixes with 65, 4 of them critical, and Microsoft Office Excel has 64, 12 of them critical. SQL Server follows with 53 fixes, and Microsoft Office Outlook has 20, 3 of them critical.
Patch first
| CVE | Product | Impact | CVSS |
|---|
| CVE-2026-124194Exploited |
Microsoft Office Outlook | Spoofing | 6.5 |
Critical vulnerabilities
and 48 more critical vulnerabilities, see the Security Update Guide
By severity
| Severity | Count |
|---|
| Critical | 63 |
| Important | 1029 |
| Moderate | 2 |
| Low | 0 |
By impact
| Impact | Count |
|---|
| Denial of service | 46 |
| Elevation of privilege | 534 |
| Information disclosure | 156 |
| Other | 1 |
| Remote code execution | 296 |
| Security feature bypass | 28 |
| Spoofing | 22 |
| Tampering | 11 |
Most affected products
| Product | Count | Critical |
|---|
| Microsoft Office Word | 65 | 4 |
| Microsoft Office Excel | 64 | 12 |
| SQL Server | 53 | 0 |
| Windows Advanced Rasterization Platform | 37 | 0 |
| Windows Installer | 36 | 0 |
| Windows Graphics Kernel | 35 | 2 |
| Windows Kernel | 28 | 0 |
| Microsoft Office SharePoint | 27 | 0 |
| Windows DNS | 22 | 0 |
| Microsoft Office Outlook | 20 | 3 |
What you should do
- 1Install the update for CVE-2026-124194 in Microsoft Office Outlook first, as Microsoft lists it as exploited.
- 2Apply the fixes for the critical remote code execution vulnerabilities in Windows Search, Windows LDAP and the Windows Xbox Live Networking Service.
- 3Review Microsoft's guidance for CVE-2026-119990 in Azure OpenAI.
- 4Update Microsoft Office, including Word, Excel and Outlook, which carry many of the critical fixes.
- 5Patch SQL Server, the Windows Advanced Rasterization Platform and Windows Installer, which have among the most fixes this month.