CrowdStrike published its analysis of Microsoft's November 2026 Patch Tuesday, detailing 1,252 total vulnerabilities. The update addresses 68 Critical flaws and one actively exploited zero-day.
The November 2026 Threat Landscape
According to CrowdStrike, Microsoft addressed 1,252 vulnerabilities in its November 2026 security update release, which includes 68 Critical vulnerabilities and one exploited zero-day. Windows received the highest number of patches at 745, followed by ESU with 658 and Microsoft Office with 201.
The leading risk types by exploitation technique are elevation of privilege with 533 patches accounting for 43 percent, remote code execution with 296 patches at 24 percent, and information disclosure with 156 patches at 12 percent.
Exploited Zero-Day and Critical Flaws
CrowdStrike highlighted CVE-2026-124194, a Moderate-severity spoofing vulnerability in Microsoft Outlook with a CVSS score of 6.5 that Microsoft confirmed is being exploited in the wild. The flaw allows a specially crafted message file to cause Outlook to connect to an attacker-controlled network location without warning, disclosing the victim's NTLMv2 hash.
Additionally, the update includes critical remote code execution vulnerabilities such as CVE-2026-112967 in the Xbox Live Networking Service and CVE-2026-116928 in the Windows Search component, both carrying a CVSS score of 9.8.
Key facts and where they come from
- Microsoft's November 2026 Patch Tuesday addresses 1,252 vulnerabilities, including one exploited zero-day and 68 Critical flaws.
Microsoft addressed 1,252 vulnerabilities in its November 2026 security update release, including one exploited zero-day vulnerability and 68 Critical vulnerabilities.
- Elevation of privilege led exploitation techniques with 533 patches, representing 43 percent of the total.
elevation of privilege with 533 patches (43%)
- CVE-2026-124194 is an actively exploited spoofing vulnerability in Microsoft Outlook with a CVSS score of 6.5.
CVE-2026-124194 is a Moderate spoofing vulnerability in Microsoft Outlook with a CVSS score of 6.5, and Microsoft confirms it is being exploited in the wild.
The open question: How will enterprises prioritize remediation for the 1,252 CVEs and the active zero-day alongside routine patch cycles?
Tell us what you think · Discuss it in the Threat Intel room
