Microsoft Patches Over 1,000 Flaws for Second Straight Month; One Outlook Bug Is Under Attack, CISA Sets Nov. 24 Deadline

Since October's record Patch Tuesday of more than 1,400 fixes, Microsoft has stayed above the 1,000-flaw mark: its Nov. 10 release is the second straight month in four digits.

The exact total depends on who is counting. Microsoft's formal list runs to 1,094 CVEs, and Krebs on Security tallied 1,093, including 63 rated Critical. BleepingComputer counted 1,235 with 66 Critical, a figure that includes 142 Microsoft Edge (Chromium-based) fixes. The Hacker News put the total at 1,259, counting 165 CVE identifiers not issued by Microsoft.

By any count, Windows accounts for the bulk: 726 flaws. Office takes 174. SQL Server, SharePoint, Exchange Server, Azure and developer tools make up the rest. More than 500 of the flaws allow elevation of privilege, with remote code execution and information disclosure behind them.

Tenable's Satnam Narang says Microsoft has now addressed more than 5,100 CVEs this year. A year ago the company was averaging around 100 patches a month, according to Krebs. Microsoft credits advances in artificial intelligence with helping find and fix such a large volume of bugs.

The Outlook bug under attack

Only one flaw carries Microsoft's "Exploitation Detected" label: CVE-2026-124194, a spoofing vulnerability in Outlook with a CVSS score of 6.5, rated Moderate.

Microsoft's advisory says an unauthenticated attacker could send a specially crafted message file and persuade a target to open it. Outlook could then connect to an attacker-controlled network location without showing its usual external-content warning. That can disclose the user's NTLMv2 hash, which could be used to authenticate as that user.

Microsoft says the Preview Pane is not an attack vector, and the attack requires user interaction. The flaw was not publicly known before the patch. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 before build 16.0.14334.21048, and Office LTSC 2024 before build 16.0.17932.21140.

Microsoft has not named a threat actor or described how the attacks work. Its advisory also does not say whether the flaw was found before or after attackers began using it. It credits two finders: a researcher called Nono, and Anthropic's Benoît Sevens, who used the company's Claude model.

The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog. Federal civilian agencies must apply the fix by Nov. 24, 2026.

Is Moderate the right label?

Some researchers dispute the severity rating. "The Moderate label undersells this one," said Jack Bicer, director of vulnerability research at Action1. "Attackers are already exploiting it, it needs only one click on an email file, and it hits Outlook, which nearly every organization runs. A stolen hash can open doors far beyond the inbox."

Bicer added that a captured hash can let an attacker sign in as the victim, read their data and move to other systems the victim can reach.

Microsoft's rating reflects the conditions it lists: network connectivity, a user opening the file, and no Preview Pane exposure. Three other Outlook bugs in the same release are rated Critical, and none is under attack, according to Microsoft's advisories.

The scarier bugs nobody is exploiting yet

The highest-scoring flaws are not the exploited one. CVE-2026-116928, a Windows Search remote code execution bug, scores 9.8. Microsoft's FAQ says an attacker could email a specially crafted attachment to an Exchange Server, which processes it automatically for indexing, so the recipient never has to open anything.

Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative, called it "a zero-click code execution bug on a high-value target." Microsoft rates its exploitability "Exploitation Less Likely."

A Windows LDAP remote code execution flaw, CVE-2026-119958, also scores 9.8. Childs said it could be "quite destructive, especially on Domain Controllers." A Windows Schannel remote code execution flaw, CVE-2026-119952, scores 8.1 but carries Microsoft's Critical label. None of the three was publicly disclosed before release.

Two Visual Studio Code flaws, CVE-2026-121662 (remote code execution) and CVE-2026-121663 (security feature bypass), are among those security teams flagged as more likely to be exploited.

Childs sees the single exploited bug as a shift in attacker methods rather than a drop in attacks. "While this is encouraging, it does not mean we're seeing less exploitation in the wild," he wrote. "It does mean we are seeing fewer 0-days exploited in the wild. This makes sense, as AI is better at reversing patches than it is at finding and exploiting bugs in closed-source software."

Other vendors and the install headaches

Microsoft was not the only vendor shipping fixes this week. Apple pushed out-of-cycle updates on Monday for at least nine vulnerabilities across iOS, iPadOS, macOS, watchOS and visionOS. Lee Neely of the SANS Institute noted that Apple backported the fix to iOS 18 and urged administrators to move to version 27.2.1 and set upgrade dates for hardware that cannot run it.

Google released Chrome 157.0.8103.50, which fixes nine flaws including CVE-2026-125350, the sixth Chrome zero-day this year. The same bug is being patched in Chromium-based browsers such as Edge. Mozilla's Firefox 160 resolves almost 100 CVEs, about half rated high severity.

On the Windows side, the Windows 11 KB5132061 update is reportedly triggering errors for some users during download and installation. The update also carries fixes for problems introduced by October's release, including an error 87 failure when adding printers.

The next hard date is Nov. 24, when federal agencies must have the Outlook fix in place. Microsoft has not said whether it will release more detail on the attacks before then.

October's exploited Windows Shell bug, CVE-2026-96951, also credited Sevens. That makes two months running in which an AI-assisted finder is credited on an exploited flaw.