Skip to main content
Change Risk Intel
Menu
Change Management

November 2026 Patch Tuesday: A CAB Plan for 1,000+ CVEs

Ben Ennis Founder, Ennis Studio · Editor, Change Risk Intel · Updated · 17 min read

No affiliate links appear in this article. CVE counts come from Microsoft’s own Security Update Guide data, linked in Sources. First published November 9, before the release; updated November 13 with the November 10 results.

Table of contents

Update, November 2026: what shipped on November 10

Updated November 13, 2026. Every count in this section comes from Microsoft’s November 2026 release notes or the November CVRF document in the Security Update Guide.

Total. The release notes list 1,094 Microsoft CVEs: Windows 726, Office 174, SQL Server 59, Developer Tools 53, SharePoint Server 27, Azure 20, Exchange Server 9, Defender 1 and 25 under “Other.” Microsoft also republished 165 non-Microsoft CVEs, not counting Chrome.

Critical. Using the same method as the chart below (Microsoft-assigned CVEs first published on Patch Tuesday), 1,093 Microsoft CVEs were new on November 10 and 63 of them are rated Critical: 48 remote code execution and 15 elevation of privilege. The CVRF document also carries a 64th Critical CVE, CVE-2026-109469 in Entra Device Registration, which was first published on November 5. That is why some tallies say 64.

Exploited at release. One. No CVE in the release is marked publicly disclosed.

Outlets reported totals from about 1,080 to 1,260. Some of the larger figures add republished third-party CVEs. TechRepublic notes that BleepingComputer’s 1,235 includes Chromium-based Edge flaws. This article uses Microsoft’s figure.

The one exploited CVE: Outlook, rated Moderate

CVE-2026-124194 is a Microsoft Outlook spoofing vulnerability with a CVSS 3.1 base score of 6.5. Microsoft rates it Moderate, the only Moderate rating among the 1,093 CVEs first published on November 10. Per the MSRC entry, an attacker sends a crafted message file and convinces the user to open it. Outlook then connects to an attacker-controlled network location “without displaying the usual external-content warning.” That discloses the user’s NTLMv2 hash, which the attacker can use to authenticate as the user. The Preview Pane is not an attack vector.

Affected products are Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions. The MSRC entry lists the security update as the remediation and no workaround. CISA added the CVE to the Known Exploited Vulnerabilities catalog on November 10 with a due date of November 24, 2026. The catalog entry points to BOD 26-04 for timing, which our BOD 26-04 decision matrix covers.

For a CAB, this is the case the two-track split below is for. A queue sorted by severity or CVSS would put this CVE near the bottom of a 1,094-item release. Exploitation puts it at the top. The fix is an Office update, not part of the Windows cumulative update, so check Office build numbers on endpoints rather than relying on Windows patch compliance.

What we got right and wrong

  • Size: right. We said to plan for a release at the September to October scale. November was the second release in a row above 1,000.
  • Trend: partly wrong. MSRC said in May that it expects releases to keep trending larger, and we passed that on. November’s 1,094 is larger than September’s 999 but about 380 CVEs smaller than October’s 1,474, so growth is not steady from one month to the next.
  • Exploited count: held. One exploited CVE at release, inside the zero-to-six range of the previous 12 months.
  • October’s known issues: mostly closed. Microsoft’s Windows 11 24H2 release health page marks the Remote Desktop 0xC000000D failure and the USB Audio Class 1.0 issue as resolved by the November update, KB5132061. The same page still lists an October-originated issue as confirmed: SQL Server linked server connections to external databases such as Oracle and PostgreSQL might remain open.
  • New known issue. KB5132061 lists install failures on some Windows 11 24H2 Enterprise and Education devices, with errors 0x80070306, 0x800f0989 or 0x800f0993. Microsoft says an automatic repair began rolling out on November 11 and should reach affected devices within 24 to 48 hours.
  • Hotpatch: as planned. Windows 11 release information lists November’s update for 24H2, 25H2 and 26H2 as hotpatch KB5132043. December 2026 is listed as a hotpatch month as well.
  • .NET: final servicing shipped. The November .NET servicing post lists .NET 8.0.34 and .NET 9.0.23 for November 10. For CVE-2026-118747, it says .NET 9 also needs the separate System.Formats.Cbor 9.0.24 package, followed by a rebuild and redeploy. Updating the runtime alone does not fix it.

Why this matters

November 10 is the second of the last three Patch Tuesdays of 2026 on the MSRC release schedule. December 8 is the third. For most US teams, November is the last normal window before a holiday freeze, because Thanksgiving falls on November 26 this year.

Our October Patch Tuesday plan treated Q4 as a lifecycle problem, because 33 Microsoft retirements landed on October 13. November has a different problem. The releases themselves have become very large, and the review process many CABs use was built for releases of 60 to 120 CVEs.

If your CAB reviews Patch Tuesday line by line, November is the month that model stops working. This piece covers how large the release was, why its size is a poor proxy for risk, and what else is due on November 10. Our Patch Tuesday planning guide covers the monthly routine.

How big was the November release?

November 10 shipped 1,094 Microsoft CVEs, per the release notes (see the update above). Before the release, we pulled every monthly release note from the Security Update Guide API for the last 12 months. Microsoft’s own CVE counts per release:

  • November 2025: 63. December 2025: 65.
  • January to June 2026: 124, 61, 97, 173, 161 and 220.
  • July: 663. August: 457.
  • September: 999. October: 1,474.

October’s 1,474 is about 23 times November 2025’s 63. The October release notes break it down: Windows 1,105, Office 164, Developer Tools 65, SharePoint Server 37, SQL Server 22 and Exchange Server 7. The same release republished 753 non-Microsoft CVEs, not counting Chrome.

Microsoft has said this is the new normal, not a spike. In a May 12 note on Patch Tuesday, MSRC wrote that “we expect releases to continue trending larger for some time.” It said AI-assisted discovery is one driver, alongside broader researcher participation. It also said “we are not changing our bug bar.” A Microsoft Security post on CISO priorities told customers to “expect a substantial increase in the number of vulnerabilities released on Patch Tuesdays” and to “increase the resources allocated to Microsoft on-premises software patching.”

Microsoft’s FORGE Lab write-up gives one concrete figure. From May through September, its agentic tooling helped find Windows bugs assigned 140 CVEs, 52 of them in the September release alone. Before the release, we said planning for a release at the September to October scale was reasonable. November’s 1,094 landed between the two.

Why CVE count is the wrong risk signal

The chart below shows what grew and what didn’t. We used the MSRC CVRF API to count, for each release, the Microsoft-assigned CVEs first published on Patch Tuesday itself. We then counted how many were rated Critical and how many were marked “Exploited: Yes” on release day.

Two-panel chart. Top: Microsoft CVEs per Patch Tuesday release from November 2025 to October 2026, rising from 63, 65, 124, 61, 97, 173, 161 and 220 to 663 in July, 457 in August, 999 in September and 1,474 in October, with Critical-rated CVEs rising from 5 to 77. Bottom: CVEs marked exploited on release day per month: 1, 1, 1, 6, 0, 2, 0, 0, 3, 1, 2, 1

The total rose 23-fold. Critical ratings rose with it, from 5 in November 2025 to 113 in September and 77 in October. But the number of CVEs already exploited at release stayed flat. Across all 12 releases, 18 CVEs carried the exploited flag on release day. The busiest month was February, at six, when the release was only 61 CVEs. October’s 1,474 CVEs included one: CVE-2026-96951, a Windows Shell security feature bypass. November’s 1,094 also included one, the Outlook flaw described above. The chart covers the 12 releases before November.

That doesn’t make the other 1,473 safe. Microsoft’s 2026 Digital Defense Report says the median time from discovery in the wild to weaponization “has fallen to well below 24 hours,” while enterprise remediation for critical external vulnerabilities “can take 30 to 60 days.” What the chart shows is that the size of the release tells you how much testing work you have, not how much urgent risk you have. Your CAB needs two tracks, one for each.

How should a CAB triage a 1,000-CVE release?

MSRC published an approach on the day of the October release. Its risk cohorts post groups CVEs that “require a similar customer assessment,” even if they don’t share a root cause or a CVSS score. Its example is a remote-access cohort of 64 CVEs across RDP client, gateway and server components. One shared question covers all of them: which RDP roles do you run, and are they reachable from outside?

For a CAB, this turns 1,000 line items into a short list of questions about your environment, answered once and recorded. Do you expose RD Gateway? Do you run SharePoint Server on premises? Which users open untrusted documents? The answers then sort each cohort into the emergency track or the normal ring rollout.

The weakness is that cohorts are not yet a product. MSRC says they are “provisional customer-risk groupings,” that the Security Update Guide “does not currently display these relationships,” and that a cohort “does not mean that one update, workaround, or mitigation addresses every CVE in the group.” You have to build the groupings yourself, and individual CVEs that are exploited, unauthenticated or use a different attack vector still need their own review.

A workable split for November 10:

  • Emergency track: anything marked exploited on release day, anything CISA adds to the KEV catalog in the following days, and unauthenticated network flaws on internet-facing roles. Our BOD 26-04 decision matrix covers the timing.
  • Normal track: everything else, deployed through your usual deployment rings, with cohort answers attached to the change record as evidence.

Our CVSS, EPSS and VPR guide explains which scores help with the normal track.

What else lands on November 10?

Microsoft’s Ending Support in 2026 list has six entries on November 10: Windows 11 Enterprise and Education 23H2, Windows 11 IoT Enterprise 23H2, .NET 8 (LTS), PowerShell 7.4 (LTS) and Azure IoT Edge 1.5 (LTS) all reach end of servicing. The Azure Functions in-process model retires.

The list misses one entry. The .NET team extended STS support to 24 months, so .NET 9 also reaches end of support on November 10. The .NET end-of-support post says .NET 8 and .NET 9 “may each receive one final update on that day if there is a known critical issue.” Both received a November 10 servicing release, 8.0.34 and 9.0.23. After that, apps keep running but get no security fixes. .NET 10 is supported through November 2028.

The .NET item is the one most likely to be missed. Runtimes live inside application builds and containers, not in the OS inventory your patch tool reports on. Ask application owners, not just the endpoint team.

What October left open

As of November 9, the October cumulative update for Windows 11 24H2, 25H2 and 26H2 (KB5127648) still listed three known issues. Microsoft now marks the Remote Desktop and USB audio issues as resolved by the November update (see the update above).

  • Smart App Control can’t be turned back on once it’s off. It’s fixed for 25H2 and 26H2 by the October 27 update, but 24H2 still needs a workaround.
  • Remote Desktop fails for non-admin users with error 0xC000000D on hosts with Administrator protection, which Microsoft’s security baselines turn on by default. As of November 9 it was fixed only for 25H2 and 26H2. Microsoft now lists it as resolved on 24H2 by KB5132061.
  • USB Audio Class 1.0 devices may fail after the September update. As of November 9 Microsoft called it “partially resolved”; it now lists the remaining symptoms as fixed by KB5132061.

The same page says Secure Boot certificate deployment “remains ongoing,” and that devices without the new certificates “can continue to start and receive standard Windows updates.” Keep tracking coverage as a separate change.

How hotpatch months change the freeze

Microsoft’s hotpatch documentation lists October as the Q4 baseline month, so November and December are hotpatch months. On enrolled Windows 11 devices, the security update installs without a restart.

That matters for the freeze. A December update that needs no restart is a much easier exception to approve than one that reboots every laptop during holiday coverage. November is your chance to confirm it works before December depends on it.

The weaknesses are real, though. Eligibility requires Windows 11 Enterprise E3 or E5 (or a listed equivalent), version 24H2 or later, virtualization-based security and Intune. Devices not on the latest baseline receive both the baseline and the hotpatch, and that does need a restart. Uninstalling a hotpatch also needs a restart, and “automatic rollback of a hotpatch update isn’t supported.” Your rollback plan has to account for that.

The November 10 CAB checklist

This table combines the release, lifecycle and known-issue data above into one view.

ItemSourceTrackCAB action
CVE-2026-124194 (Outlook, exploited at release; KEV due Nov 24)Security Update Guide, CISA KEVEmergencyUpdate Office builds within your exploited-CVE SLA
New KEV additions after Nov 10CISA KEVEmergencyWatch the KEV tracker daily
Remaining 1,093 Microsoft CVEsRelease notesNormalGroup into cohorts, roll through rings
.NET 8 and .NET 9 end of support (final releases 8.0.34, 9.0.23).NET blogLifecycleFind runtimes in apps and containers; record a decision
Windows 11 23H2 Ent/Edu, PowerShell 7.4, IoT Edge 1.5Microsoft LifecycleLifecycleUpgrade or record the risk
24H2 install failures and SQL Server linked server issueKB5132061, release healthTestAdd to pilot ring test cases
Hotpatch enrollmentMicrosoft LearnFreeze prepConfirm baseline coverage before December 8

Our free Patch Tuesday calendar lists the next 12 release dates. More process guides are on the change management hub.

What to do about it

  1. Patch Outlook CVE-2026-124194 by November 24. It is the only CVE exploited at release. Verify Office builds on endpoints, not just Windows patch status.
  2. Plan testing capacity for 1,000 or more CVEs. November’s 1,094 confirms the September and October releases are the right sizing guide, not last year’s.
  3. Split the release into two tracks. Exploited and internet-facing items go to the emergency track. Everything else follows your rings.
  4. Write your cohort questions once and reuse them. Record answers on RDP exposure, on-premises SharePoint and Exchange, and untrusted-document handling, so triage takes hours, not days.
  5. Find every .NET 8 and .NET 9 runtime. Check application builds, container images and build agents, then upgrade to .NET 10 or record an exception with an owner.
  6. Add current known issues to pilot testing. Check November install success on 24H2 Enterprise and Education devices, and SQL Server linked server connections, before broad rollout.
  7. Check hotpatch baseline coverage. Devices that missed the October baseline restarted in November. Fix that before December 8 so December stays restart-free.
  8. Pre-approve December 8 before the freeze starts. Set its scope, pilot gate, emergency exception path and rollback owner while the CAB still meets weekly.

FAQ

When is the November 2026 Patch Tuesday?

Tuesday, November 10, 2026, per the MSRC 2026 release schedule. December 8 is the last Patch Tuesday of the year, and January 12, 2027 is the next one after that.

How many CVEs did the November 2026 Patch Tuesday fix?

Microsoft’s release notes list 1,094 Microsoft CVEs, plus 165 republished non-Microsoft CVEs, not counting Chrome. Of the 1,093 first published on November 10, 63 are rated Critical. Other outlets report different totals depending on what they include.

Which November 2026 Patch Tuesday CVE is exploited?

CVE-2026-124194, a Microsoft Outlook spoofing vulnerability rated Moderate with a CVSS score of 6.5. Opening a crafted message file can leak the user’s NTLMv2 hash. CISA added it to the KEV catalog on November 10 with a due date of November 24, 2026.

Do more CVEs mean more risk?

Not on their own. In our count of the 12 releases before November, CVEs marked exploited on release day stayed between zero and six a month, while total volume rose about 23-fold. November’s 1,094 CVEs included one exploited flaw, rated only Moderate. Volume drives testing workload; exploitation and exposure drive urgency.

What are Microsoft risk cohorts?

They are groups of CVEs that need the same assessment of your environment, such as which RDP roles you expose. MSRC introduced them on October 13, 2026 as provisional groupings. They aren’t shown in the Security Update Guide yet, so you build them yourself.

Did .NET 9 reach end of support in November 2026?

Yes. Microsoft extended STS releases to 24 months, so .NET 9 reached end of support on November 10, 2026, the same day as .NET 8. Both received a final servicing release that day, 9.0.23 and 8.0.34. .NET 10 is supported through November 2028.

Is November a hotpatch month for Windows 11?

Yes. Microsoft’s hotpatch cycle uses October as the Q4 baseline, so November and December updates install without a restart on eligible, enrolled devices. Devices not on the latest baseline still restart, and hotpatch rollback isn’t automatic.

Sources

#patch tuesday #november 2026 #change advisory board #vulnerability prioritization #hotpatch #dotnet end of support

Published November 9, 2026. Last updated November 13, 2026.