Microsoft's November Patch Tuesday Ships 1,093 Fixes, Four of Them Set the Week

TL;DR

• Patch Tuesday is the monthly release in which Microsoft publishes its security fixes for Windows, Office, SQL Server, Exchange, Azure and the rest of its catalogue, and the November 2026 edition carries 1,093 CVEs.
• The release spans 63 critical CVEs, 1,029 important CVEs and one moderate CVE across 287 products and components.
• SQL Server carries a critical 9.8 score through CVE-2026-116945, a heap-based buffer overflow that lets an unauthenticated attacker execute code over the network.
• One zero-day sets the priority order: CVE-2026-124194 is an Outlook spoofing flaw at 6.5 that Microsoft says was exploited in the wild before the patch.
• Tenable also flags CVE-2026-118146 in Active Directory Domain Services at 8.8 and CVE-2026-119952 in Schannel at 8.1, both assessed as Exploitation More Likely.
• Elevation of privilege fills almost half the catalogue at 48.9 percent of the total, against 27.1 percent for remote code execution, which is why the count reads as a queue for an identity problem.
• The patch order a small team can run: unauthenticated network code execution first, the exploited zero-day second, exploitation-likely privilege escalation third, then the rest on a normal cycle.
• Weekly prioritization combines a score's ranking of impact and reach with the advisory's exploitation facts.

1,093 patches make triage the real work

Tenable counts 1,093 CVEs in the November 2026 release, spread over 287 products and components. The largest single bucket is Microsoft Office Word with 65 CVEs, followed by Microsoft Office Excel at 64 and SQL Server at 53, then Windows components in the thirties and twenties.

Those counts are the starting point for the triage order below. A patch list of this size makes triage the useful work: selecting the set that can hurt an estate in the coming days.

The impact chart tells a second story. Elevation of privilege accounts for 48.9 percent of the vulnerabilities patched, followed by remote code execution at 27.1 percent.

SQL Server has a critical 9.8 score

CVE-2026-116945 is a serious flaw in the release: a heap-based buffer overflow in SQL Server, scored 9.8, where an unauthorized attacker executes code over a network. The CVE record lists SQL Server 2017, 2019, 2022 and 2025 builds below their November fix levels, so the range runs from SQL Server 2017 through SQL Server 2025.

A database server that answers on a network port and carries a 9.8 unauthenticated overflow belongs at the front of the queue. The record's vector string reads AV:N/AC:L/PR:N/UI:N, which describes a network attack at low complexity with no privileges and no user interaction, and that combination is what turns a patching task into a same-day item.

One zero-day sets the priority

Exploitation in the wild gives the Outlook flaw immediate urgency. CVE-2026-124194 is an Outlook spoofing flaw at 6.5, and Microsoft states it was exploited in the wild as a zero-day. Tenable's description of the mechanism is concrete: a crafted Office file convinces a user to open it, and the attacker walks away with a valid NTLMv2 hash to impersonate that user later.

The advisory credits the discovery to a security researcher who used Claude, Anthropic's large language model, and names no version. That detail is worth recording: a Microsoft security advisory now credits a language model as the tool behind a find, in plain text, inside the same table that carries the CVSS score.

The Outlook fix reaches laptops that leave the building, expanding the patching scope. The hash-stealing mechanism turns one unpatched mailbox into a credential problem for everything that mailbox can reach.

Elevation of privilege fills almost half the catalogue

Elevation of privilege at 48.9 percent is the number to sit with. Those flaws matter after somebody already has a foothold, and a stack of them is what turns a single phished session into domain administrator.

Tenable lists CVE-2026-118146 in Active Directory Domain Services at 8.8, where an authenticated attacker exploits incorrect authorization to run code over the network, with Microsoft's assessment at Exploitation More Likely. CVE-2026-119952 in Schannel is the other one worth naming: 8.1, unauthenticated, built on an observable timing discrepancy, and again assessed as Exploitation More Likely.

A patch order for a small team

Here is a triage order for a team without a dedicated vulnerability programme:

1. SQL Server and anything else with an unauthenticated network path, tested and installed on the day the fix is available.
2. The exploited zero-day, on every endpoint that runs the client, because the exploit is already in circulation.
3. The Exploitation More Likely privilege escalation set, starting with domain services and the TLS stack.
4. Everything else on the normal monthly cycle, with the browser and Office families ahead of the rest.

Two habits make that order survive contact with a real week. The first is recording which build each server runs, because a CU-level fix and a GDR-level fix are different downloads for the same CVE. The second is watching whether the estate actually rebooted, since patch status is a monitoring fact and the numbers above only describe what Microsoft shipped; whether the reboot happened shows up in infrastructure monitoring with plain-language alerts.

The list above is also where a small estate feels its limits. Nobody reads 1,093 records, and the teams that cope well use a standing order: network-reachable first, exploited second, privilege escalation third. That order survives a month when the count doubles, which is the only property worth designing for.

Sources

• Microsoft's November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194), Tenable, 10 November 2026
• CVE-2026-116945, Microsoft SQL Server remote code execution, CVE Program
• CVE-2026-124194, Microsoft Outlook spoofing, CVE Program
• CVE-2026-118146, Windows Active Directory Domain Services, CVE Program

Source: Tenable's November 2026 Patch Tuesday write-up and the CVE Program records for CVE-2026-116945, CVE-2026-124194 and CVE-2026-118146, all fetched on 11 November 2026. Those pages carry the 1,093 count, the severity split, the impact chart values, every score and the exploitation assessments named above.