)
)
November is the second four-figure Patch Tuesday in a row. Microsoft’s release includes 1,093 CVEs, with 63 rated Critical and one zero-day: Microsoft confirms attackers are already exploiting CVE-2026-124194. The rest of the headliners will sound familiar.
Exchange Server gets a Critical remote code execution fix that Microsoft rates more likely to be exploited. Outlook gets its third Preview Pane remote code execution fix in three months. And SharePoint Server carries a 9.9 CVSS score under an Important label, so the severity label alone won’t tell you what to patch first.
CVE-2026-124194 [Exploited]
Microsoft Outlook spoofing vulnerability
CVE-2026-124194 (CVSS 6.5/10) is a Moderate-rated Outlook bug that Microsoft has already seen exploited, and that moves it ahead of every higher score in your Office rollout. Push the fix to your endpoints today.
The bug leaks credentials rather than running code. An unauthenticated attacker sends a specially crafted message file, and when the user opens it, Outlook connects to an attacker-controlled network location without showing the usual external-content warning. That connection discloses the user’s NTLMv2 hash, which the attacker can use to authenticate as that user. The score stays low because nothing executes, but a working hash is a working login.
The fix covers Microsoft 365 Apps for Enterprise, Office LTSC 2024, and Office LTSC 2021, with fixed builds of 16.0.17932.21140 for LTSC 2024 and 16.0.14334.21048 for LTSC 2021.
How attackers may exploit this vulnerability
An attacker with no account on your systems sends a crafted message file and convinces the user to open it in Outlook. The Preview Pane isn’t an attack vector, so the user has to open the file. Outlook then reaches out to the attacker’s server and hands over the user’s NTLMv2 hash.
What to look out for
Outlook making outbound connections to unfamiliar external hosts, particularly over SMB (TCP 445), in firewall and endpoint logs.
Office LTSC installs still below the fixed builds above.
Mitigation guidance
Push the Office update now and confirm the installed build on each endpoint.
Block outbound SMB (TCP 445) to the internet at the perimeter and on host firewalls. On Windows 11 24H2 and Windows Server 2025, SMB NTLM blocking stops clients from sending NTLM to remote servers.
CVE-2026-118207 [Critical]
Microsoft Exchange Server remote code execution vulnerability
CVE-2026-118207 (CVSS 8.8/10) belongs in this week’s emergency window for every Exchange Server Subscription Edition server you run. It’s a Critical remote code execution bug that Microsoft rates Exploitation More Likely, and all an attacker needs to start is a low-level login.
The flaw is improper input validation. An authenticated attacker with low-level access sends the server a specially crafted request and runs code on it. Code on an Exchange server reaches every mailbox it hosts. And Exchange usually holds broad rights in Active Directory, so the mailboxes are just the start.
Microsoft lists one affected product: Exchange Server Subscription Edition RTM.
How attackers may exploit this vulnerability
An attacker who holds any low-privilege credential the server accepts sends a crafted request over the network and executes code on the Exchange server, with no user interaction required.
What to look out for
Exchange servers reachable from the internet. A sprayed or reused password supplies the low-level login this attack starts from.
Exchange Server 2016 and 2019 machines still in service. Microsoft’s list names only Subscription Edition, so find out where they stand before you mark Exchange done this month.
Mitigation guidance
Patch internet-facing Exchange servers this week, then internal ones.
Book the restart Microsoft flags for this update now. Exchange servers rarely go down outside a planned window.
CVE-2026-110043 [Critical]
Microsoft Office Outlook remote code execution vulnerability
CVE-2026-110043 (CVSS 8.8/10) makes three months in a row that Microsoft has fixed an Outlook remote code execution bug with the Preview Pane as an attack vector. It’s rated Exploitation Less Likely, but it’s still Critical, so it belongs in this week’s Office update, not a later ring.
October’s was CVE-2026-70242, a 9.8 Critical, and September brought another. This one asks a little more of the victim. October’s bug ran as soon as Outlook rendered the message. This heap-based buffer overflow needs the user to select the crafted email so it displays in the Preview Pane. That’s still one click, in a list people click through all day.
How attackers may exploit this vulnerability
An attacker with no account on your systems sends a crafted email. When the user selects it and Outlook shows it in the Preview Pane, the overflow runs the attacker’s code with that user’s permissions.
What to look out for
Office builds that trail the current security release on endpoints that show fully patched for Windows. Microsoft 365 Apps updates arrive from the Office content delivery network on their own schedule, separate from Windows Update.
Office LTSC 2021 installations. Microsoft lists them alongside Microsoft 365 Apps for Enterprise and Office LTSC 2024, so they’re in scope for this update.
Mitigation guidance
Push the Office update this week, then confirm the installed Office build on each endpoint.
CVE-2026-120002 [Important]
Microsoft SharePoint Server elevation of privilege vulnerability
CVE-2026-120002 scores a 9.9 and carries an Exploitation More Likely assessment, yet its label reads Important. Trust the score and the assessment over the label, and patch your on-premises SharePoint farms this week.
The flaw is incorrect authorization. That 9.9 comes from a changed scope: a successful attack reaches past the vulnerable SharePoint component itself.
Microsoft lists one affected product: SharePoint Server Subscription Edition. The fix ships as KB5002945.
How attackers may exploit this vulnerability
An attacker who already holds a low-privileged account sends requests over the network and elevates their privileges, with no user interaction required.
What to look out for
SharePoint farms that face the internet or host external users. Any account that can sign in is a starting point for this attack.
Patch queues sorted by severity label. Under an Important label, this 9.9 can land behind lower-scored Critical bugs.
Mitigation guidance
Install KB5002945 on SharePoint Server Subscription Edition farms this week, starting with farms that face the internet or host external users.
Patch regularly, patch often
Start with the zero-day, since attackers are already using CVE-2026-124194. After that, Exchange and SharePoint each open to any low-privilege login, and Outlook needs one click in the Preview Pane.
Patch internet-facing Exchange and SharePoint servers next, and book the Exchange restart now. Push the Office update this week, then check the installed build, because a fully patched Windows dashboard says nothing about Office. Rank by score and assessment, not label.
Four-figure months are the baseline now, and a patch cycle built for a few hundred CVEs won’t keep up. Automox sees what’s installed on every Windows, macOS, and Linux endpoint and applies fixes on the schedule you set, and Automox Mitigation Worklets™ cover what a patch can’t. Patch what’s patchable. Mitigate what isn’t.
Sources
Microsoft Security Response Center – November 2026 Security Updates – Full list of November 2026 Patch Tuesday advisories, CVSS scores, and exploitation status
Microsoft Security Update Guide – Per-CVE details, affected products, and KB articles, including KB5002945 for CVE-2026-120002
CISA – Known Exploited Vulnerabilities Catalog – Authoritative tracker for actively exploited CVEs
Microsoft – Overview of the update process for Microsoft 365 Apps – Office content delivery network updates, update channels, and installation deadlines
)
)
)