November Patch Tuesday: What to Patch First

Microsoft's November 2026 Patch Tuesday, released on November 10, was enormous: more than a thousand vulnerabilities across nearly 300 products and components. Counts vary by tracker, from 1,093 to 1,235, depending on what each one includes. By Tenable's count, 63 are rated Critical.

No team patches a thousand things in a week. Here is how to find the handful that matter most.

The exploited one: Outlook NTLM hash theft (CVE-2026-124194)

Microsoft reports that CVE-2026-124194, a spoofing flaw in Microsoft Outlook, was exploited in the wild before the fix. Outlook fails to warn the user before a potentially unsafe action. An attacker who persuades someone to open a crafted Office file can obtain that user's NTLMv2 password hash, which can be cracked offline or relayed to impersonate the user on other systems.

Microsoft rates it Moderate (CVSS 6.5), but the rating understates the risk. Stolen credentials are how many serious intrusions begin, and CISA added the flaw to the Known Exploited Vulnerabilities catalog the same day.

What to do:

• Deploy the Office and Outlook updates now, across desktops and any terminal servers.
• Block outbound SMB (TCP 445) at the network edge so hashes cannot be sent to attacker servers on the internet.
• Reduce NTLM use where you can, and require SMB signing to make relayed hashes harder to use.
• Put privileged accounts in Active Directory's Protected Users group, which prevents NTLM authentication for them.

These steps also defend against the many other NTLM hash leaks that appear every year.

The critical ones to prioritize

Of the 63 Critical fixes, these stand out:

• Windows Schannel (CVE-2026-119952, CVSS 8.1): remote code execution through a timing flaw, and the only one in this group that needs no authentication. Schannel handles TLS for Windows services, so exposure can be broad.
• Active Directory Domain Services (CVE-2026-118146, CVSS 8.8): remote code execution by an authenticated attacker. Domain controllers are the keys to the network; patch them early.
• Exchange Server (CVE-2026-118207, CVSS 8.8): remote code execution by an authenticated attacker. On-premises Exchange has a long history of rapid exploitation.
• Windows Network Address Translation (CVE-2026-113862, CVSS 8.1): remote code execution.

Microsoft assesses all four as "exploitation more likely."

Also note SharePoint Server (CVE-2026-120002): an elevation of privilege flaw scored CVSS 9.9 but rated Important. It requires authentication, but on-premises SharePoint servers that face the internet should still move up the list.

Beyond Microsoft: same-day KEV additions

On November 10, CISA added six vulnerabilities to the KEV catalog, including the Outlook flaw:

• Barracuda Email Security Gateway (CVE-2026-116606), an authentication bypass, and a flaw affecting multiple Barracuda products (CVE-2026-111560). Both carry three-day federal deadlines, the most urgent tier under BOD 26-04.
• Google Chromium (CVE-2026-125350), a use-after-free exploited in the wild. Update Chrome, Edge and other Chromium-based browsers.
• Cisco BroadWorks (CVE-2026-20320) and Openwave Webtop Media Transcoder (CVE-2026-111793).

Email gateways are edge devices, and edge devices are where attackers start. If you run Barracuda ESG, treat this as an emergency and check for signs of compromise after patching. Our November threat roundup covers why.

Making a record-sized release manageable

1. Start with exploited and KEV-listed flaws, regardless of their severity rating.
2. Then internet-facing systems: email gateways, Exchange, SharePoint, VPNs and anything else reachable from outside.
3. Then identity infrastructure: domain controllers and the servers that authenticate users.
4. Then the remaining Critical fixes, using EPSS and your own exposure data to order them. See Prioritizing Vulnerabilities.
5. Let routine patching handle the rest on your normal cycle.

A release this large is also a reminder to test updates before broad deployment and to make sure you can roll back. Our guide to Patch Management That Keeps Pace covers how.

How CDT can help

CDT's vulnerability research and managed security teams help organizations prioritize and verify patching, and our cyber hunt team checks exposed systems for compromise when a flaw was exploited before the fix.

Sources

• Microsoft November 2026 Patch Tuesday addresses 1,093 CVEs (Tenable)
• Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day (BleepingComputer)
• Known Exploited Vulnerabilities Catalog (CISA)
• Security Update Guide (Microsoft)