Welcome to the November 2026 Patch Tuesday recap. Today is also Sesame Street Day, so I’ll be channeling my inner Oscar the Grouch, which requires zero acting on my part. A trash can, a bad attitude, and a deep distrust of anything that shows up uninvited is basically the sysadmin job description.
Let’s get into the details and see how many CVEs Microsoft has for us this month. I’d love to be optimistic here, but I’m assuming this number of the day will be so large that even Count von Count would need to sit down, loosen his cape, and ask for a calculator.
Severity
Total exploits patched: 1,093
Critical patches: 63
Important: 1,029
Moderate: 1
Low: 0
Vulnerability impact
Remote code execution: 296
Elevation of privilege: 535
Information disclosure: 156
Spoofing: 22
Tampering: 11
Denial of service: 46
Feature bypass: 27
Availability
Publicly disclosed: 0
Actively exploited: 1
Some highlights (or lowlights)
CVE-2026-124194: Out of 1,093 CVEs, Microsoft gave us exactly one actively exploited vulnerability, and it’s a Microsoft Outlook spoofing bug rated Moderate with a 6.5 CVSS score. It’s not publicly disclosed either, so the bad guys know something we don’t. It’s a good reminder that a low score and a Moderate rating don’t mean the exploit isn’t already being used against someone. Patch it, and maybe nudge your users one more time about the emails they open.
CVE-2026-120002: This SharePoint Server elevation of privilege vulnerability comes in at a 9.9, tied for the highest CVSS score this month. While only given a severity rating of Important, this EoP does have a network attack vector, low complexity, and no user interaction required. Seeing as this is only one of the 27 SharePoint CVEs this month, consider this your sign to stop hosting your own SharePoint servers. You deserve better than that.
Microsoft Office: I know we’ve already highlighted two Office products, but why stop now when we’re on a roll? Especially since Office made up 201 of our 1,093 CVEs this month. That’s nearly one in every five CVEs this month, and it’s spread across the whole suite: Word has 65, Excel has 64 (12 of them Critical), SharePoint has 27, Outlook has 20, general Office components have 9, Access and PowerPoint each have 7, and Visio even got 2. Good job, little buddy. If that’s not bad enough, 154 of the 201 are remote code execution. Bravo Office, you win.
Wrapping up
And that concludes November's Patch Tuesday recap. Today's episode was brought to you by the letter F, for fixes, failures, and the colorful vocabulary you'll inevitably develop when one causes the other. Happy patching. May your reboots be few and your maintenance windows uneventful.
