The November 2026 Security Update Review

The penultimate month of 2026 bring with it the usual storm of patches from Microsoft and Adobe. I’ve been prototyping some new ways to display this data, but as always, I’m open to suggestions. Seriously – hit me up on Bluesky if you have any ideas. If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release.

Adobe Patches for November 2026

For the first part of the November release, Adobe released nine bulletins addressing 110 unique CVEs in Adobe Connect, Experience Manager, After Effects, Audition, Dimension, Photoshop, Media Encoder, Premiere, and Content Credentials SDK.

Here’s this month’s overview table:

Adobe Patches for November 2026

Bulletin IDProductCVE CountHighest SeverityHighest CVSSExploitedDeployment Priority

APSB26-191Adobe Connect24Critical10.0No2
APSB26-189Adobe Experience Manager14Critical9.9No2
APSB26-102Adobe Audition11High8.7No3
APSB26-100Adobe After Effects17High8.6No3
APSB26-190Adobe Dimension1High8.2No3
APSB26-181Adobe Photoshop13High7.8No3
APSB26-101Adobe Premiere11High7.8No3
APSB26-103Adobe Media Encoder6High7.8No3
APSB26-184Content Credentials SDK13Medium6.5No3
TOTAL9 bulletins110

Obviously, if you need to prioritize, the Connect patch is the biggest and most severe bulletin this month: 24 CVEs, 18 of them Critical, with a top CVSS of 10.0. It’s Priority 2, and Adobe is not aware of any exploits in the wild. Each of the CVSS10 bugs are reachable over the network with no authentication or user interaction, and each changes scope. The other Critical-rated update for this month is in Experience Manager. It addresses 14 CVEs, which includes four Critical bugs with a CVSS 9.9 rating. Two are incorrect-authorization bugs and two are code injections. All give arbitrary code execution over the network. Each needs a low-privileged account but no user interaction, and each changes scope.

Besides the bugs already mentioned, all other patched from Adobe are a Deployment Priority 3. None of the other Adobe bugs receiving patches this month are listed as publicly known or under active attack at the time of release.

Microsoft Patches for November 2026

Well, at least it’s not a new record for Microsoft. As always, the overall count is a bit confusing, but I see about 1,090 new CVEs released today. At this point, does the exact number actually matter? Regardless of the actual count, it’s huge but less than the 1,400 or so released last month. That’s two months in a row that have exceeded all previous years from Microsoft. As for the products affected by this release, we have Windows and Windows components; Office and Office Components; Windows networking and remote access; Windows graphics, media and printing; Windows storage file systems and drivers; .NET and Visual Studio; Windows Security and identity; Azure, cloud and identity; Exchange Server; Microsoft Dynamics; and Xbox. We’ll see how close I came to matching Microsoft’s “Cohorts” list.

 Interestingly, there is only one bug under active attack, and none are publicly known this month. While this is encouraging, it does not mean we’re seeing less exploitation in the wild. It does mean we are seeing fewer 0-days exploited in the wild. This makes sense, as AI is better at reversing patches than it is at finding and exploiting bugs in closed-source software.

Let’s begin by covering some of the more severe and interesting patches released this month.

–              CVE-2026-124194 – Microsoft Outlook Spoofing Vulnerability
This is the one bug under active attack this month. It’s labeled spoofing, but the impact is bigger than the name suggests. An attacker sends a specially crafted message file and convinces a user to open it. Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user’s NTLMv2 hash. The attacker can use that hash to authenticate as the user. The Preview Pane is not an attack vector, and the CVSS is only 6.5, so don’t let the score lull you. Microsoft marks it as exploited, so this one goes to the top of the list.

–              CVE-2026-116928 – Windows Search Remote Code Execution Vulnerability
We start with Windows Search, which is reached through Exchange Server. This bug allows an unauthenticated attacker to send an email with a specially crafted attachment that triggers the bug when the server automatically indexes it. The recipient never opens anything. It is a zero-click code execution bug on a high-value target. It’s also a CVSS 9.8 and clearly more severe than any of the nine patches Exchange receives this month.

–              CVE-2026-119958 – Windows LDAP – Lightweight Directory Access Protocol Remote Code Execution Vulnerability
This patch addresses a bug that allows an unauthenticated attacker to exploit an out-of-bounds (OOB) write (CWE-787)

Read the original article:

The November 2026 Security Update Review