Microsoft Patches 1,093 Vulnerabilities, Outlook Zero-Day Exploited

Microsoft has released a massive November 2026 Patch Tuesday update, addressing a staggering 1,093 security vulnerabilities across its Windows operating systems and supported software. The updates include fixes for 63 critical flaws, one of which is an actively exploited zero-day vulnerability in Microsoft Outlook.

The volume of patches this month contributes to a significant total of more than 5,100 security updates shipped by Microsoft so far this year. This represents a substantial increase from an average of approximately 100 patches per month a year ago, a trend Microsoft attributes in part to advances in artificial intelligence aiding bug discovery and resolution.

Among the 63 critical flaws, nearly half are remote code execution (RCE) vulnerabilities that could allow attackers to seize control of a Windows system with little or no user interaction. Additionally, 535 of the addressed flaws could permit an attacker to elevate their privileges on an affected device.

The actively exploited zero-day, tracked as CVE-2026-124194, is a spoofing bug affecting Microsoft 365 Apps for Enterprise and various editions of Microsoft Office. Users are strongly advised to apply these updates immediately to mitigate the risk of exploitation. The US Cybersecurity and Infrastructure Security Agency (CISA) typically adds actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue, urging federal agencies to patch swiftly.

Other Major Vendors Release Urgent Updates

Microsoft’s Patch Tuesday arrives amid a flurry of critical security updates from other major software providers.

Apple released out-of-cycle security updates on Monday, addressing at least nine vulnerabilities across iOS/iPadOS, macOS, watchOS, and visionOS. These fixes reportedly include resolving an iMessage flaw that could allow a remote attacker to join a group chat and access its messages, as well as a separate bug permitting group members to view messages sent before they joined. Lee Neely, an instructor at the SANS Institute, highlighted the importance of these updates, noting Apple backported fixes to older iOS versions and urging users to ensure all Apple devices are running the latest versions, such as iOS 27.2.1. Apple’s security releases are detailed on its support pages.

Google also rolled out Chrome version 157.0.8103.50 this week, patching nine security holes. This includes CVE-2026-125350, the sixth zero-day vulnerability discovered in Chrome this year, which also affects other Chromium-based browsers like Microsoft Edge. This follows a substantial update on November 3, which fixed 213 vulnerabilities.

Mozilla released Firefox 160, resolving almost 100 Common Vulnerabilities and Exposures (CVEs), with approximately half classified as high severity. Details are typically available on Mozilla’s security advisories page.

Adobe simultaneously issued patches for at least 110 vulnerabilities across its product range, with nearly half also rated high severity. Adobe confirmed there is no evidence of active exploitation for the flaws it addressed this month. Adobe’s security bulletins can be found on its Product Security Incident Response Team (PSIRT) pages.

Managing the Patch Volume

The sheer volume and criticality of recent patches can be overwhelming for security teams, according to Chris Goettl, vice president of product management at Ivanti. He noted that while roughly 95,000 CVEs have been assigned across all vendors this year, only 217 have been added to CISA’s KEV list, indicating active exploitation.

“Roughly four in ten of this year’s exploited vulnerabilities sit in operating systems, endpoint software, browsers, and server platforms, which a continuous patch strategy can close quickly,” Goettl explained. “The rest calls for exposure management alongside patching, especially the 44% that sit in edge devices and IT management or remote access tools, the internet-facing systems that hold privileged access.”

Organisations are advised to maintain a consistent patching strategy, prioritise updates for actively exploited vulnerabilities, and ensure comprehensive backup of important data before applying major operating system updates.