# Microsoft November 2027 Patch Tuesday: 1,260 CVEs

Published: 2026-11-10 · Severity: severe
Canonical: https://vorant.io/reports/c2a350cc-12bf-522e-add0-89163a4cf3e7/microsoft-november-2027-patch-tuesday-1-260-cves
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Microsoft patched 1,260 vulnerabilities including 68 critical, with an Outlook spoofing flaw (CVE-2026-124194) already exploited in the wild.

Source: isc.sans.edu — https://isc.sans.edu/diary/rss/33508

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-124194 as exploited in the wild.

SANS ISC's November 2027 Patch Tuesday summary covers an unusually large Microsoft release of 1,260 vulnerabilities, 68 rated critical, including 167 Chromium-based issues affecting Microsoft Edge. One vulnerability, CVE-2026-124194, an Outlook spoofing flaw, is confirmed under active exploitation and should be prioritized for patching regardless of its lower CVSS profile typical of spoofing bugs. The advisory also flags several high-impact critical RCE vulnerabilities not yet reported as exploited: CVE-2026-119958 in Microsoft LDAP, a cluster of critical flaws in Microsoft Message Queuing (MSMQ) (CVE-2026-109459, CVE-2026-119967, CVE-2026-116710, CVE-2026-119963, CVE-2026-119964), and CVE-2026-113859, a Windows TCP/IP RCE with a comparatively low CVSS of 7.5 but broad reach given TCP/IP's ubiquity.

Beyond the headline items, the release spans the full breadth of the Microsoft ecosystem: .NET and ASP.NET Core DoS/EoP/information-disclosure bugs, Azure services (DevOps Server, CycleCloud, Front Door, OpenAI, Entra Device Registration — the latter rated critical with a 10.0 CVSS and requiring no customer action), Exchange Server RCE/EoP/spoofing issues (including critical CVE-2026-118207), Microsoft Defender RCE (CVE-2026-122194), Graphic Fonts RCE (CVE-2026-119969), DirectMusic and Color Management RCEs, and numerous driver/kernel elevation-of-privilege issues (Desktop Window Manager, HID Parser Library, Kernel Streaming Service). The 167 Chromium/Edge CVEs cover a wide range of memory-corruption, use-after-free, type-confusion and authorization bugs, several rated critical.

Defenders should prioritize the exploited Outlook spoofing CVE immediately, then focus remediation on the MSMQ, LDAP, Entra Device Registration, Exchange, and Defender criticals given their RCE/EoP potential and the scale of likely deployment across enterprise environments. Standard patch-management cycles should treat this as a high-priority month given both the exploited CVE and the unusually high critical count.

## Mentioned in this report

- Vulnerabilities: CVE-2026-100204, CVE-2026-102224, CVE-2026-105581, CVE-2026-109457, CVE-2026-109459, CVE-2026-109467, CVE-2026-109469, CVE-2026-113859, CVE-2026-114146, CVE-2026-114160, CVE-2026-114162, CVE-2026-114164, CVE-2026-116710, CVE-2026-118148, CVE-2026-118149, CVE-2026-118150, CVE-2026-118154, CVE-2026-118207, CVE-2026-118309, CVE-2026-118321, CVE-2026-118740, CVE-2026-118742, CVE-2026-119958, CVE-2026-119963, CVE-2026-119964, CVE-2026-119967, CVE-2026-119969, CVE-2026-119990, CVE-2026-121035, CVE-2026-121126, CVE-2026-121203, CVE-2026-122194, CVE-2026-124194 (KEV), CVE-2026-76024, CVE-2026-85923, CVE-2026-95882, CVE-2026-95901, CVE-2026-96010, CVE-2026-96067, CVE-2026-96078

Source reporting: https://isc.sans.edu/diary/rss/33508

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c2a350cc-12bf-522e-add0-89163a4cf3e7/microsoft-november-2027-patch-tuesday-1-260-cves.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup