Microsoft has released its monthly security update for November 2026, addressing a total of 1095 vulnerabilities across various products. Among these, 64 vulnerabilities have been classified as 'critical' by Microsoft.
CVE-2026-124194 affects Microsoft Office Outlook and is categorized as a spoofing vulnerability with a CVSS base score of 6.5.
CVE-2026-113862, affecting Windows Network Address Translation, is a remote code execution vulnerability with a CVSS score of 8.1. Microsoft considers its exploitation more likely.
CVE-2026-118146 and CVE-2026-118207, both remote code execution vulnerabilities affecting Active Directory Domain Services and Microsoft Exchange Server respectively, have a CVSS score of 8.8. Microsoft also considers these vulnerabilities more likely to be exploited.
Additionally, CVE-2026-119952, a remote code execution vulnerability in Windows Schannel, has a CVSS score of 8.1 and is considered more likely to be exploited by Microsoft.