Microsoft’s November 2026 Patch Tuesday addressed a large set of vulnerabilities across its ecosystem: Microsoft reported 1,235 vulnerabilities in this month’s updates, including 63 rated critical and 1,029 rated important. The release also fixed 142 vulnerabilities impacting Microsoft Edge (Chromium-based) and included one vulnerability that has been exploited in the wild.
Patch Tuesday summary and immediate priorities
Microsoft’s November updates include fixes for vulnerabilities that could enable remote code execution, privilege escalation, or denial-of-service attacks. CISA added the patched Outlook vulnerability (an unauthenticated attack that can cause Outlook to connect to an attacker-controlled network location and disclose authentication information) to its Known Exploited Vulnerabilities Catalog and urged users to patch it before November 24, 2026. Qualys InstaScan showed customers their November findings 40 minutes before Microsoft’s advisory page was updated.
Critical and high-impact fixes
Microsoft listed multiple critical vulnerabilities across a range of components. The release highlights include (CVE identifiers and descriptions as provided):
– CVE-2026-120003 Microsoft Office Remote Code Execution Vulnerability: a heap-based buffer overflow that may allow unauthenticated remote code execution.
– CVE-2026-118148 Active Directory Domain Services Elevation of Privilege Vulnerability: an improper authentication flaw that may allow authenticated privilege elevation over a network.
– CVE-2026-119382 Windows TPM Elevation of Privilege Vulnerability: a heap-based buffer overflow that may allow authenticated local privilege elevation.
– CVE-2026-119961 Windows Internet Information Services Remote Code Execution Vulnerability: a race condition that may allow unauthenticated remote code execution.
– CVE-2026-119962 Windows CredSSP Remote Code Execution Vulnerability: a double-free flaw that may allow unauthenticated remote code execution.
– CVE-2026-110043 Microsoft Office Outlook Remote Code Execution Vulnerability: a heap-based buffer overflow that may allow unauthenticated remote code execution.
– CVE-2026-125137 Windows Graphics Kernel Elevation of Privilege Vulnerability: a heap-based buffer overflow that may allow authenticated local privilege elevation.
– CVE-2026-118207 Microsoft Exchange Server Remote Code Execution Vulnerability: an improper input validation flaw that may allow an authenticated attacker to execute code over a network.
The updates also include extensive Excel and Word fixes: multiple CVEs in Microsoft Office Excel (including double-free, heap-based, and stack-based buffer overflow flaws such as CVE-2026-118702, CVE-2026-118296, CVE-2026-118701, CVE-2026-118297) and Microsoft Office Word (including CVE-2026-110047, CVE-2026-110067, CVE-2026-124185).
Windows platform and other component highlights
Windows-specific critical fixes include numerous Hyper-V elevation-of-privilege issues (for example CVE-2026-119947, CVE-2026-113860), Message Queuing remote code execution flaws (for example CVE-2026-119963, CVE-2026-119964), and vulnerabilities affecting TCP/IP, SMB, Print Spooler, Codecs Library, Raw Image Extension, and more. Other notable Microsoft fixes cover Visual Studio Code (CVE-2026-121662 and CVE-2026-121663), Azure OpenAI (CVE-2026-119990 missing authentication for a critical function), Azure DevOps Server (CVE-2026-112745 server-side request forgery), and a range of elevation-of-privilege and information-disclosure issues across Windows components listed in the release.
Adobe November 2026 advisories
Adobe released nine advisories addressing 63 vulnerabilities across Adobe After Effects, Adobe Photoshop, Adobe Premiere, Adobe Audition, Adobe Experience Manager (AEM), and Adobe Dimension. Four of those vulnerabilities are rated critical. Successful exploitation may lead to arbitrary code execution, according to the advisories.
Release summary by product family
The Microsoft release summary provided counts by product family as listed in the advisory: Azure 20, Defender 1, Developer Tools 53, Exchange Server 9, Office 174, Other 25, SQL Server 59, SharePoint Server 27, Windows 726. The release summary shows a total of 1,094 vulnerabilities and 53 distinct updates in that breakdown.
Qualys VMDR, QQL queries and remediation guidance
Qualys states that VMDR automatically detects new Patch Tuesday vulnerabilities using continuous Knowledgebase updates. The source provides QQL queries to locate impacted hosts and missing patches for this Patch Tuesday. Example QQL to find impacted hosts by vulnerability QID:
vulnerabilities.vulnerability: ( qid: 110541 or qid: 110542 or qid: 110543 or qid: 389347 or qid: 389348 or qid: 389349 or qid: 389350 or qid: 50153 or qid: 92505 or qid: 92506 or qid: 92507 or qid: 92508 or qid: 92509 or qid: 92511 or qid: 92512 or qid: 92513 or qid: 92514 or qid: 92515 )
And the QQL to return the missing patches for this Patch Tuesday (as provided):
( qid: 110541 or qid: 110542 or qid: 110543 or qid: 389347 or qid: 389348 or qid: 389349 or qid: 389350 or qid: 50153 or qid: 92505 or qid: 92506 or qid: 92507 or qid: 92508 or qid: 92509 or qid: 92511 or qid: 92512 or qid: 92513 or qid: 92514 or qid: 92515 )
Qualys notes that TruRisk Eliminate and VMDR can be used to prioritize and deploy applicable per-technology version patches and that users can select the respective QIDs in the Patch Catalog and filter for “Missing” patches to identify and deploy available patches.
What’s next
The next Patch Tuesday is scheduled for December 8, 2026. The Qualys Research team will host a monthly webinar to review high-impact vulnerabilities and demonstrate steps to address them using Qualys VMDR and TruRisk Eliminate. The source encourages subscription to the ‘This Month in Vulnerabilities and Patches’ webinar series.
