Microsoft November 2027 Patch Tuesday: 1,260 CVEs
Microsoft patched 1,260 vulnerabilities including 68 critical, with an Outlook spoofing flaw (CVE-2026-124194) already exploited in the wild.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-124194 as exploited in the wild.
SANS ISC's November 2027 Patch Tuesday summary covers an unusually large Microsoft release of 1,260 vulnerabilities, 68 rated critical, including 167 Chromium-based issues affecting Microsoft Edge. One vulnerability, CVE-2026-124194, an Outlook spoofing flaw, is confirmed under active exploitation and should be prioritized for patching regardless of its lower CVSS profile typical of spoofing bugs. The advisory also flags several high-impact critical RCE vulnerabilities not yet reported as exploited: CVE-2026-119958 in Microsoft LDAP, a cluster of critical flaws in Microsoft Message Queuing (MSMQ) (CVE-2026-109459, CVE-2026-119967, CVE-2026-116710, CVE-2026-119963, CVE-2026-119964), and CVE-2026-113859, a Windows TCP/IP RCE with a comparatively low CVSS of 7.5 but broad reach given TCP/IP's ubiquity.
Beyond the headline items, the release spans the full breadth of the Microsoft ecosystem: .NET and ASP.NET Core DoS/EoP/information-disclosure bugs, Azure services (DevOps Server, CycleCloud, Front Door, OpenAI, Entra Device Registration — the latter rated critical with a 10.0 CVSS and requiring no customer action), Exchange Server RCE/EoP/spoofing issues (including critical CVE-2026-118207), Microsoft Defender RCE (CVE-2026-122194), Graphic Fonts RCE (CVE-2026-119969), DirectMusic and Color Management RCEs, and numerous driver/kernel elevation-of-privilege issues (Desktop Window Manager, HID Parser Library, Kernel Streaming Service). The 167 Chromium/Edge CVEs cover a wide range of memory-corruption, use-after-free, type-confusion and authorization bugs, several rated critical.
Defenders should prioritize the exploited Outlook spoofing CVE immediately, then focus remediation on the MSMQ, LDAP, Entra Device Registration, Exchange, and Defender criticals given their RCE/EoP potential and the scale of likely deployment across enterprise environments. Standard patch-management cycles should treat this as a high-priority month given both the exploited CVE and the unusually high critical count.
Mentioned in this report
Source reporting: https://isc.sans.edu/diary/rss/33508
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs