The penultimate month of 2026 bring with it the usual storm of patches from Microsoft and Adobe. I’ve been prototyping some new ways to display this data, but as always, I’m open to suggestions. Seriously – hit me up on Bluesky if you have any ideas. If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release.

Adobe Patches for November 2026

For the first part of the November release, Adobe released nine bulletins addressing 110 unique CVEs in Adobe Connect, Experience Manager, After Effects, Audition, Dimension, Photoshop, Media Encoder, Premiere, and Content Credentials SDK.

Here’s this month’s overview table:

Obviously, if you need to prioritize, the Connect patch is the biggest and most severe bulletin this month: 24 CVEs, 18 of them Critical, with a top CVSS of 10.0. It’s Priority 2, and Adobe is not aware of any exploits in the wild. Each of the CVSS10 bugs are reachable over the network with no authentication or user interaction, and each changes scope. The other Critical-rated update for this month is in Experience Manager. It addresses 14 CVEs, which includes four Critical bugs with a CVSS 9.9 rating. Two are incorrect-authorization bugs and two are code injections. All give arbitrary code execution over the network. Each needs a low-privileged account but no user interaction, and each changes scope.

Besides the bugs already mentioned, all other patched from Adobe are a Deployment Priority 3. None of the other Adobe bugs receiving patches this month are listed as publicly known or under active attack at the time of release.

Microsoft Patches for November 2026

Well, at least it’s not a new record for Microsoft. As always, the overall count is a bit confusing, but I see about 1,090 new CVEs released today. At this point, does the exact number actually matter? Regardless of the actual count, it’s huge but less than the 1,400 or so released last month. That’s two months in a row that have exceeded all previous years from Microsoft. As for the products affected by this release, we have Windows and Windows components; Office and Office Components; Windows networking and remote access; Windows graphics, media and printing; Windows storage file systems and drivers; .NET and Visual Studio; Windows Security and identity; Azure, cloud and identity; Exchange Server; Microsoft Dynamics; and Xbox. We’ll see how close I came to matching Microsoft’s “Cohorts” list.

 Interestingly, there is only one bug under active attack, and none are publicly known this month. While this is encouraging, it does not mean we’re seeing less exploitation in the wild. It does mean we are seeing fewer 0-days exploited in the wild. This makes sense, as AI is better at reversing patches than it is at finding and exploiting bugs in closed-source software.

Let’s begin by covering some of the more severe and interesting patches released this month.

-              CVE-2026-124194 - Microsoft Outlook Spoofing Vulnerability
This is the one bug under active attack this month. It’s labeled spoofing, but the impact is bigger than the name suggests. An attacker sends a specially crafted message file and convinces a user to open it. Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user’s NTLMv2 hash. The attacker can use that hash to authenticate as the user. The Preview Pane is not an attack vector, and the CVSS is only 6.5, so don’t let the score lull you. Microsoft marks it as exploited, so this one goes to the top of the list.

-              CVE-2026-116928 - Windows Search Remote Code Execution Vulnerability
We start with Windows Search, which is reached through Exchange Server. This bug allows an unauthenticated attacker to send an email with a specially crafted attachment that triggers the bug when the server automatically indexes it. The recipient never opens anything. It is a zero-click code execution bug on a high-value target. It’s also a CVSS 9.8 and clearly more severe than any of the nine patches Exchange receives this month.

-              CVE-2026-119958 - Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
This patch addresses a bug that allows an unauthenticated attacker to exploit an out-of-bounds (OOB) write (CWE-787) by sending crafted LDAP calls over the network, with no user interaction. Since it runs code in the LDAP service context, it could be quite destructive, especially on Domain Controllers. Test and deploy this one quickly.

-              CVE-2026-119990 - Azure OpenAI Elevation of Privilege Vulnerability
This is an odd duck. The bulletin says “Customer Action Required: Yes” for this bug, but nothing in the advisory tells customers what to do. There are no mitigations, workarounds, or customer steps. The FAQ says an unauthenticated attacker can send a crafted request over the internet to an affected Azure OpenAI service, with no account or user interaction. The impact is access to orchestration information, workflow changes, or service disruption. Hopefully, Microsoft adds some direction here soon.

-              CVE-2026-119952 - Windows Schannel Remote Code Execution Vulnerability
This flaw allows an unauthenticated attacker to exploit arbitrary code over a network without user interaction. Microsoft rates this bug as “Exploitation More Likely”. It is one of only a few Critical-rated patches with that rating. They also list the attack complexity as high, which is why the CVSS score is lower than the others. I would still put this near the top of my list.

-              CVE-2026-95962 - Windows Virtual Filtering Platform (VFP) Remote Code Execution Vulnerability
I include this one because it’s in a little-documented component. It’s not the first CVE in VFP, but it appears to be just the second. It’s a use-after-free that allows an unauthenticated attacker to get code execution on affected targets by sending a specially crafted packet to the affected service over the network. No authentication or user interaction is needed. There is a race condition here, but we see those overcome all the time at Pwn2Own. This should be an interesting component to watch.

-              CVE-2026-112967 - Windows Xbox Live Networking Service Remote Code Execution Vulnerability
You don’t see a lot of Xbox Live bugs, but here we are with a CVSS 9.8.  This bug is a heap overflow that doesn’t need authentication or user interaction. Microsoft states the attacker can “gain remote code execution via an in-network attacker calling arbitrary endpoints.” Is this really likely? Probably not, but it’s fun to think of Xbox Live exploits in the wild.

On to those that are Wormable…

Last month saw 59 bugs that fit this definition. This month, it’s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing.

These bugs are as follows:

• Message Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967

• DNS (4): CVE-2026-81384, 96092, 96177, 88218

• Two each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801)

• One each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945)

I may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange

Here’s the full list of CVEs released by Microsoft for November 2026: