November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far
But as Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, warns, don’t let the score or the name lull you into thinking it’s OK to put off patching this one.
- Starting with the zero-day: It’s an Outlook spoofing vulnerability, tracked as CVE-2026-124194, and it only garnered a 6.5 out of 10 CVSS rating.
- Childs says this shouldn’t give organizations “false comfort.” “Logging back-to-back months above 1,000 CVEs proves automated bug-hunting has permanently reset patch volume,” he told The Register.
- “It’s labeled spoofing, but the impact is bigger than the name suggests,” Childs said in his monthly Patch Tuesday review.
It’s another doozy of a Patch Tuesday, with Microsoft fixing 1,094 bugs in its products, including one that attackers exploited before Redmond released a patch.
Back-to-back months of 1K+ CVEs Despite the second month of more than 1,000 CVEs (October had 1,474), CVE-2026-124194 is the only one under active exploitation, and none of the 1,094 are listed as publicly known.
- The attacker can use that hash to authenticate as the user.” Microsoft marked CVE-2026-124194 as exploited, but per usual didn’t say when the attacks started, who is battering this bug, and what they are doing with the access post exploitation.
- Plus, now that there’s a public fix, other miscreants are undoubtedly already scanning for vulnerable versions and reverse engineering the patch for their own attack purposes.
- “With AI making patch-diffing and exploit generation near-instant, the threat window opens the minute these updates drop.” For defenders, this means two things, Childs added.
- This one can be exploited by sending specially crafted LDAP requests to vulnerable systems, potentially compromising domain controllers.
- And…Xbox remote code execution And finally, for funsies, a critical flaw in the Windows Xbox Live Networking Service, CVE-2026-112967, that could allow remote code execution also made this month's roundup.
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →