Microsoft Patches Three Critical Flaws, One Already Exploited
November's Patch Tuesday carries remote-code-execution flaws scored 9.8, 9.8 and 8.1, plus an Outlook spoofing flaw, CVE-2026-124194, that CISA lists as exploited in the wild.
Microsoft's November Patch Tuesday fixed three critical remote-code-execution flaws and an Outlook spoofing flaw already listed as exploited.
Microsoft's November Patch Tuesday, released November 10, patches three remote-code-execution flaws scored near the top of the severity scale. [Microsoft Patch Tuesday November 2026: Windows Search and LDAP RCEs, exploited Outlook spoofing — Rescana (November 10)]
The three code-execution flaws carry CVSS scores of 9.8, 9.8 and 8.1. Separately, an Outlook spoofing vulnerability, CVE-2026-124194, is already listed in CISA's Known Exploited Vulnerabilities catalog, with federal agencies directed to remediate by November 24. [Microsoft Patch Tuesday November 2026: Windows Search and LDAP RCEs, exploited Outlook spoofing — Rescana (November 10)]
The distinction that matters in any Patch Tuesday is between severe and exploited. A 9.8 that nobody has used yet is an emergency on a schedule; a spoofing flaw already in the KEV catalog is an emergency now, because listing there means CISA has evidence of exploitation, not just a vendor's warning. Spoofing in Outlook is a phishing-grade weakness: it helps a sender impersonate a trusted one, which is how credential theft campaigns start. The November 24 federal deadline is the tell for private operators too, since CISA sets those dates from observed risk, not from the calendar. [Microsoft Patch Tuesday November 2026: Windows Search and LDAP RCEs, exploited Outlook spoofing — Rescana (November 10)]
The working order writes itself: the exploited Outlook flaw first, the 9.8 code-execution pair on internet-facing and identity-adjacent systems next, the rest of the month's roll on the normal cycle, with the usual caution that a CVSS score isn't a schedule of attacks, it's a ceiling on harm. November's set also lands in a month when Fortinet disclosed seven critical flaws of its own, a reminder that the patch queue is now a standing workload across vendors, not a monthly event. Admins who treat Patch Tuesday as a meeting instead of a deployment will keep falling behind it. [Microsoft Patch Tuesday November 2026: Windows Search and LDAP RCEs, exploited Outlook spoofing — Rescana (November 10)]
The conversation.
Loading comments…
A little more perspective.
Reading is free. Verified members can comment and reply for $2 a month.