Patch Tuesday November 2026: 1,093 fixes, 1 exploited. What to patch first

Patch Tuesday used to be a list you could read over coffee. In August 2026 Microsoft released 402 of its own CVEs on Patch Tuesday. In September it was 972, in October 1,408, and on 10 November 1,093. Nobody reads a thousand advisories a month, and nobody patches a thousand things in order of severity either.

So we counted. This page takes Microsoft's own monthly security update data for the last four Patch Tuesdays, checks every CVE against CISA's KEV catalog and FIRST's EPSS scores, and asks one question: which signals would have pointed you at the bugs attackers actually used? The method is at the end, and you are welcome to reuse the numbers with a link back.

November 2026 Patch Tuesday in numbers

Microsoft's monthly document also lists 548 more CVEs that other organisations issued for open-source parts Microsoft ships, such as the Chromium engine in Edge. Two of those are on KEV this month: the Chromium bug CVE-2026-125350 and the OpenSSH bug CVE-2026-123158. They are not in our counts, but they belong on your list.

The one that matters: the Outlook zero-day (CVE-2026-124194)

CVE-2026-124194 is the only November bug Microsoft marked as exploited, and CISA added it to KEV on the same day with a federal deadline of 24 November. In Microsoft's description, an attacker sends a crafted file and persuades someone to open it in Outlook. Outlook then connects to a server the attacker controls without showing its usual external-content warning, and that leaks the user's NTLMv2 password hash, which can be used to sign in as them.

• Severity: Moderate, CVSS 6.5. It needs the user to open the file, and Microsoft says the Preview Pane is not a way in. On paper that sounds minor.
• In practice it is a credential theft bug that attackers were already using. That is why it is the first thing to patch this month, ahead of every Critical on the list.
• What to do: install the November Office and Outlook updates, then confirm on a sample of machines that the update is really there. If you can, also block outbound SMB (TCP 445) to the internet, which limits this whole class of hash-leak attacks.

Four months of Patch Tuesday: severity missed every exploited bug

All six exploited CVEs were rated Important or Moderate. Four were privilege-escalation or bypass bugs in Windows, the kind attackers chain after they already have a foothold, and one was the Outlook credential leak. The sixth is a useful warning:

What EPSS got right, and where it falls short

EPSS estimates the chance a CVE will be exploited in the next 30 days. It did better than severity here, with a catch.

• It ranks well. On 14 November the Outlook zero-day had an EPSS score of 1.6%, which sounds tiny, but only six of November's 1,093 Microsoft CVEs scored higher. Sorted by EPSS, it is on the first screen. Sorted by severity, it is near the bottom.
• Its numbers look small. Not one of the 3,875 CVEs from these four months scores 10% or more today, not even the exploited ones. If your rule is "patch anything over 10%", you would patch none of them. Use EPSS to rank, not as a pass mark.
• It lags. EPSS learns from what it sees. Across all of 2026, 81% of the CVEs CISA added to KEV had no EPSS score or a score under 10% the day before they were listed (CISA KEV statistics). KEV tells you what has happened; EPSS tells you what is likely. You want both.

A patch order that would have caught all six

1. Anything on CISA's KEV list, now. Check every month's KEV additions against your whole estate, not just the latest Patch Tuesday, so late listings like the SharePoint bug get caught. Our Exploited now page lists the last 30 days.
2. Internet-facing systems next. A remote code execution bug on an exposed Exchange, SharePoint or RD Gateway server is a different emergency from the same bug on an internal desktop.
3. Then sort the rest by EPSS, highest first, and give the top 1 to 2% a short deadline.
4. Then severity, to break ties and to plan the routine monthly rollout.
5. Rescan and prove it. A patch that was deployed is not the same as a patch that installed. Rescan, compare against the last scan, and close only what the scan shows is gone.

That is the order Varaxon Scan Hub uses when it builds a report from your scan export: KEV findings first, then EPSS, then severity, with each finding showing the evidence behind its place in the list. You can try the same ordering on a single CVE with the free CVE checker, or read more about the approach in risk-based vulnerability management.

How we counted

• Source: Microsoft's public monthly security update documents for August to November 2026 (the CVRF data behind the Security Update Guide), read on 14 November 2026.
• What counts as a CVE here: CVEs Microsoft itself assigned, first released on the Patch Tuesday date. CVEs Microsoft added later in the month, and CVEs other organisations assigned for third-party components, are left out. That is why our totals can differ slightly from other write-ups.
• Critical: the CVE has a Critical rating for at least one affected product in Microsoft's data.
• Exploited: on CISA's KEV catalog, version 2026.11.13. Microsoft's own "exploited" flag matched KEV for five of the six; the sixth (CVE-2026-65660) was listed by CISA later.
• EPSS: FIRST's EPSS API, scores dated 14 November 2026.

We will add December's numbers after the next Patch Tuesday on 8 December 2026.

Common questions