November Patch Tuesday: An Overflowing Cornucopia of CVEs

November offers up a veritable Patch Tuesday feast of vulnerabilities that are more likely to be exploited. In its second four-digit Patch Tuesday release in a row, Microsoft today addressed 1,093 security vulnerabilities, with 63 rated critical, and one zero-day in the mix (CVE-2026-124194, CVSS 6.5) that Microsoft confirmed is under active exploit. "Most security teams haven't quite recovered from the last month of bumper-to-bumper critical vulnerabilities, emergency patches, and '2shell'-branded everything, and we're yet again at another Patch Tuesday," says Jake Knott, head of threat intelligence at Watchtowr. "Teams are really starting to feel the strain of working out what actually matters when there is fire after fire every day demanding immediate attention," he adds. "Our advice hasn't changed … start with what you actually have exposed to the Internet, then what's already being exploited in the wild, and only then everything else. Before going into panic mode, check whether you even use the vulnerable component, or meet the prerequisites for exploitation." To that end, security teams should prioritize CVE-2026-124194, and not just because attackers are already targeting it. It's a spoofing vulnerability in Outlook that may not allow code execution, hence its moderate severity rating, but could allow the disclosure of an account’s NTLMv2 hash — and in turn, the target's login. "To exploit it, an attacker sends a target a malicious Office file and convinces them to ope...