Microsoft Patch Tuesday: Actively Exploited Zero-Day
Microsoft's November 2026 Patch Tuesday fixes multiple RCE flaws across Windows, Exchange, SharePoint and Office; CVE-2026-124194 is exploited in the wild.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-124194 as exploited in the wild.
This is the MS-ISAC advisory summarizing Microsoft's November 10, 2026 Patch Tuesday release, covering multiple vulnerabilities across Azure, Defender, Developer Tools, Exchange Server, Office, SQL Server, SharePoint Server, and Windows. The most severe vulnerabilities could allow remote code execution, granting an attacker the privileges of the logged-on user — potentially enabling installation of programs, data manipulation, or creation of new accounts with full user rights. Impact is reduced for accounts configured with least-privilege access.
Microsoft has confirmed that CVE-2026-124194 is being exploited in the wild, making timely patching a priority for all affected systems. The advisory does not provide further technical detail on the exploited vulnerability or the full list of CVEs, directing readers to Microsoft's own release for the complete vulnerability list. Defenders should prioritize patching internet-facing and high-value systems (Exchange, SharePoint, SQL Server) and apply standard hardening measures — least privilege, network segmentation, anti-exploitation features, and vulnerability scanning — as outlined in the recommendations.
Mentioned in this report
Detection guidance
Office Application Spawning Script Interpreter or LOLBin
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Office processes spawning shells, script hosts or common LOLBins, a typical post-exploitation outcome of client-side Office exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Script Interpreter or LOLBin
description: Detects Office applications (Word, Excel, PowerPoint, Outlook) spawning
command shells, script hosts or common proxy-execution binaries. This is a generic
post-exploitation indicator of client-side exploitation, such as an Office RCE zero-day,
and is not tied to a specific CVE.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
- \OUTLOOK.EXE
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \rundll32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Legitimate Office macros or add-ins that launch cmd.exe or PowerShell for business
automation
- Document management or ERP plug-ins that shell out from Excel
level: medium
id: 7fa624b3-7170-52ba-93ca-74316decfdda
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-november-10-2026_2026-132
IIS Worker Process of Exchange or SharePoint Spawning Shell
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects w3wp.exe running an Exchange or SharePoint application pool and spawning a command shell or download utility, indicating server-side exploitation or webshell activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS Worker Process of Exchange or SharePoint Spawning Shell
description: Detects the IIS worker process (w3wp.exe) hosting an Exchange or SharePoint
application pool spawning cmd, PowerShell or download and proxy-execution binaries.
This is a generic post-exploitation pattern for RCE against Exchange or SharePoint
and is not tied to a specific CVE.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \w3wp.exe
ParentCommandLine|contains:
- MSExchange
- SharePoint
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
- \mshta.exe
- \wscript.exe
- \cscript.exe
condition: selection_parent and selection_child
falsepositives:
- Exchange or SharePoint management components that legitimately launch PowerShell
from the application pool
- Custom SharePoint solutions that invoke command-line tools
level: medium
id: 8bc79ea5-0e66-5b14-abd9-57277eaecb1f
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-november-10-2026_2026-132
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-november-10-2026_2026-132
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs