Report Name: Microsoft Patch Tuesday, November 2026
Generated: 2026-11-11 13:08:31

Product Name	Prevalence	U	C	H	M	L	A	Comment
Active Directory	0.9				1		1	Active Directory is a directory service developed by Microsoft for Windows domain networks
Windows Container Manager Service	0.9				1		1	Windows component
Windows DNS Server	0.9			1	3		4	Windows component
Windows Kernel	0.9			1	27		28	Windows Kernel
Windows NTLM	0.9				1		1	A suite of security protocols to authenticate users' identity and protect the integrity and confidentiality of their activity
Windows SMB Client	0.9				4		4	Windows component
Windows TCP/IP	0.9			1	3		4	Windows component
Windows Win32k	0.9				8		8	The Win32k.sys driver is the kernel side of some core parts of the Windows subsystem. Its main functionality is the GUI of Windows; it's responsible for window management.
ASP.NET Core	0.8				14		14	An open-source, server-side web-application framework designed for web development
Kernel Streaming Service Driver	0.8				1		1	The Kernel Streaming Service Driver is a Windows kernel-mode component that manages low-latency, real-time streaming of multimedia data between hardware devices and applications
Microsoft Bluetooth Driver	0.8				1		1	Microsoft Bluetooth Driver
Microsoft Brokering File System	0.8				1		1	The Microsoft Brokering File System (BFS) is a Windows component designed to act as an intermediary for file access in isolated (sandboxed) Win32 applications
Microsoft Defender	0.8			1			1	Anti-malware component of Microsoft Windows
Microsoft Exchange	0.8			2	7		9	Microsoft Exchange Server is a mail server and calendaring server developed by Microsoft
Microsoft Office	0.8			5	4		9	Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer
Microsoft PowerShell	0.8			1	6		7	PowerShell or Microsoft PowerShell (formerly Windows PowerShell) is a task automation and configuration management program from Microsoft, consisting of a command-line shell and the associated scripting language
Microsoft Windows App Store	0.8			1			1	Windows component
Microsoft Windows Codecs Library	0.8			1	1		2	Windows component
Microsoft Windows Media Foundation	0.8			1	1		2	Windows component
Microsoft Windows SCSI Class System File	0.8				2		2	Windows component
Microsoft Windows Search Component	0.8				2		2	Windows component
Microsoft Windows Speech	0.8				1		1	Windows component
Microsoft Windows VMSwitch	0.8				1		1	Windows component
Quality Windows Audio/Video Experience (QWAVE) service	0.8				3		3	Windows component
RPC	0.8			1			1	Remote Procedure Call Runtime
Remote Access API	0.8				1		1	Remote Access API
Server for NFS	0.8				1		1	Windows component
Windows Domain Name Service	0.8			6			6	Windows component
Windows Active Directory	0.8			1	1		2	Windows component
Windows Active Directory Certificate Services	0.8				1		1	Windows component
Windows Active Directory Domain Services	0.8			1	1		2	Windows component
Windows Admin Center	0.8				1		1	Windows component
Windows Advanced Rasterization Platform	0.8				37		37	Windows component
Windows Ancillary Function Driver for WinSock	0.8				1		1	Windows component
Windows App Readiness Service	0.8				1		1	Windows component
Windows AppContainer	0.8				1		1	Windows component
Windows AppX Deployment Service	0.8			1	1		2	Windows component
Windows AppX Package Manager	0.8				1		1	Windows component
Windows Audio Service	0.8				8		8	Windows component
Windows Autopilot	0.8				1		1	Windows component
Windows Background Intelligent Transfer Service (BITS)	0.8				1		1	Windows component
Windows Backup Engine	0.8				1		1	Windows component
Windows Bind Filter Driver	0.8				1		1	Windows component
Windows Biometric Service	0.8				3		3	Windows component
Windows BitLocker	0.8				2		2	Windows component
Windows Bluetooth A2DP driver	0.8				1		1	Windows component
Windows Bluetooth Port Driver	0.8				1		1	Windows component
Windows Bluetooth Service	0.8				2		2	Windows component
Windows Broadcast DVR User Service	0.8				8		8	Windows component
Windows Broker Infrastructure Service	0.8				1		1	Windows component
Windows Brokering File System	0.8				3		3	Windows component
Windows CD-ROM Driver	0.8				2		2	Windows component
Windows CNG Key Isolation Service	0.8				1		1	Windows component
Windows COM	0.8				3		3	Windows component
Windows COM+ Event System Service	0.8				3		3	Windows component
Windows Camera Frame Server Monitor	0.8				3		3	Windows component
Windows Client for NFS	0.8			2	4		6	Windows component
Windows Clipboard Virtual Channel Extension	0.8				1		1	Windows component
Windows Cloud Files Mini Filter Driver	0.8				5		5	Windows component
Windows Composite Image File System	0.8				1		1	Windows component
Windows Connected User Experiences and Telemetry	0.8				3		3	Windows component
Windows Connection Manager Service	0.8				2		2	Windows component
Windows Container Isolation FS Filter Driver (unionfs.sys)	0.8				3		3	Windows component
Windows CredSSP	0.8			1			1	Windows component
Windows Credential Manager	0.8				1		1	Windows component
Windows Credential User Interface	0.8				1		1	Windows component
Windows DHCP Client	0.8				4		4	Windows component
Windows DHCP Server	0.8			3	6		9	Windows component
Windows DIAL Client	0.8				1		1	Windows component
Windows DNS	0.8			3	18		21	Windows component
Windows DPAPI (Data Protection Application Programming Interface)	0.8				1		1	Windows component
Windows DWM Core Library	0.8				4		4	Windows component
Windows Defender Firewall Service	0.8				1		1	Windows component
Windows Deployment Services	0.8			2	3		5	Windows component
Windows Desktop Window Manager	0.8				2		2	Windows component
Windows Device Association Service	0.8				4		4	Windows component
Windows Device Inventory	0.8				1		1	Windows component
Windows Devices Human Interface	0.8				1		1	Windows component
Windows Diagnostic Policy Service	0.8				3		3	Windows component
Windows Distributed File System (DFS)	0.8				1		1	Windows component
Windows Distributed Transaction Coordinator	0.8				2		2	Windows component
Windows Encrypting File System (EFS)	0.8				2		2	Windows component
Windows Enhanced Storage	0.8				1		1	Windows component
Windows Error Reporting	0.8				5		5	Windows component
Windows Event Collector Service	0.8				2		2	Windows component
Windows Event Logging Service	0.8				1		1	Windows component
Windows Event Viewer	0.8				1		1	Windows component
Windows FTP Service	0.8				1		1	Windows component
Windows Failover Cluster	0.8				1		1	Windows component
Windows Fast FAT Driver	0.8				1		1	Windows component
Windows File Server Resource Management Service	0.8				4		4	Windows component
Windows FileCrypt Driver	0.8				3		3	Windows component
Windows Filter Manager	0.8				2		2	Windows component
Windows Filtering Platform (WFP)	0.8				3		3	Windows component
Windows Function Discovery Resource Publication	0.8			1	1		2	Windows component
Windows Function Discovery SSDP Provider	0.8			1			1	Windows component
Windows GDI	0.8				3		3	Windows component
Windows Graphics Kernel	0.8				35		35	Windows component
Windows HTTP.sys	0.8				2		2	Windows component
Windows IP Translation Configuration Service	0.8				1		1	Windows component
Windows Image Acquisition	0.8			1			1	Windows component
Windows Imaging Component	0.8			1			1	Windows component
Windows Input System	0.8				2		2	Windows component
Windows Installer	0.8				36		36	Windows component
Windows Internet (wininet.dll)	0.8				1		1	Windows component
Windows Internet Connection Sharing (ICS)	0.8				5		5	Windows component
Windows Internet Information Services	0.8			1	2		3	Windows component
Windows Inventory Backup	0.8				1		1	Windows component
Windows JScript	0.8			1			1	Windows component
Windows Kerberos	0.8			1	5		6	Windows component
Windows Kernel Transaction Manager	0.8				4		4	Windows component
Windows Kernel-Mode Drivers	0.8				1		1	Windows component
Windows LDAP - Lightweight Directory Access Protocol	0.8			1			1	Windows component
Windows LUA File Virtualization Filter Driver	0.8				2		2	Windows component
Windows Language Experience Service	0.8				1		1	Windows component
Windows Layer-2 Bridge Network Driver	0.8				1		1	Windows component
Windows Link Layer Topology Discovery Protocol	0.8			2	1		3	Windows component
Windows Link-Layer Discovery Protocol (LLDP)	0.8				2		2	Windows component
Windows Local Security Authority Subsystem Service (LSASS)	0.8				7		7	Windows component
Windows Local Session Manager (LSM)	0.8				1		1	Windows component
Windows MIDI Service Module	0.8				3		3	Windows component
Windows Management Instrumentation	0.8			1	7		8	Windows component
Windows Management Services	0.8				1		1	Windows component
Windows Maps	0.8				1		1	Windows component
Windows Media Player	0.8			1			1	Windows component
Windows Message Queuing	0.8			3	5		8	Windows component
Windows Message Queuing Queue Manager	0.8			2			2	Windows component
Windows Microsoft Account Sign-in Assistant	0.8				2		2	Windows component
Windows Modern Device Management (MDM)	0.8			2	3		5	Windows component
Windows Multiple Provider Router	0.8				1		1	Windows component
Windows NTFS	0.8			2	5		7	The default file system of the Windows NT family
Windows NetBIOS	0.8				4		4	Windows component
Windows Network Address Translation (NAT)	0.8			2			2	Windows component
Windows Network Connected Devices Auto-Setup Service	0.8			1			1	Windows component
Windows Network Connection Broker	0.8				3		3	Windows component
Windows Network File System	0.8				1		1	Windows component
Windows OLE	0.8				2		2	Windows component
Windows OLE DB	0.8				1		1	Windows component
Windows Overlay Filter	0.8				6		6	Windows component
Windows PCI Bus Driver	0.8				2		2	Windows component
Windows Partition Management Driver	0.8				1		1	Windows component
Windows Performance Counters	0.8			2	1		3	Windows component
Windows Performance Monitor	0.8			1			1	Windows component
Windows Phone Service	0.8				1		1	Windows component
Windows Point-to-Point Protocol over Ethernet (PPPoE)	0.8				2		2	Windows component
Windows PowerShell	0.8			1			1	Windows component
Windows Print Spooler Components	0.8			1	19		20	Windows component
Windows PrintWorkflowUserSvc	0.8				2		2	Windows component
Windows Program Compatibility Assistant Service	0.8				2		2	Windows component
Windows Projected File System	0.8				2		2	Windows component
Windows Projected File System Filter Driver	0.8				1		1	Windows component
Windows Push Notification Core	0.8				1		1	Windows component
Windows Push Notifications	0.8				1		1	Windows component
Windows RNDIS	0.8				1		1	Windows component
Windows Raw Image Extension	0.8			1			1	Windows component
Windows Redirected Drive Buffering	0.8				1		1	Windows component
Windows Redirected Drive Buffering System	0.8				1		1	Windows component
Windows Remote Access API	0.8				1		1	Windows component
Windows Remote Access Connection Manager	0.8				1		1	Windows component
Windows Remote Assistance	0.8				1		1	Windows component
Windows Remote Desktop	0.8				1		1	Windows component
Windows Remote Desktop Client	0.8			4	8		12	Remote Desktop Protocol Client
Windows Remote Desktop Services	0.8				5		5	Remote Desktop Services, known as Terminal Services in Windows Server 2008 and earlier, is one of the components of Microsoft Windows that allow a user to initiate and control an interactive session on a remote computer or virtual machine over a network connection
Windows Resilient File System (ReFS)	0.8				2		2	Windows component
Windows Rich Text Edit Control	0.8			1			1	Windows component
Windows SMB	0.8			1	1		2	Windows component
Windows SMB Server Network Transport Driver (srvnet.sys)	0.8			1			1	Windows component
Windows SMBv3 Server	0.8			1			1	Windows component
Windows Sandbox	0.8				1		1	Windows component
Windows Schannel	0.8			1			1	Windows component
Windows Search	0.8			1			1	Windows component
Windows Secure Kernel Mode	0.8				1		1	Windows component
Windows Secure Socket Tunneling Protocol (SSTP)	0.8				2		2	Windows component
Windows Security Account Manager	0.8				2		2	Windows component
Windows Security Account Manager Remote Protocol	0.8				1		1	Windows component
Windows Sensor Data Service	0.8				1		1	Windows component
Windows Servicing Stack Updates	0.8				1		1	Windows component
Windows Setup and Deployment	0.8				2		2	Windows component
Windows Shell	0.8			1	4		5	Windows component
Windows Simple Search and Discovery Protocol (SSDP) Service	0.8				1		1	Windows component
Windows Smart Card	0.8				6		6	Windows component
Windows State Repository Service	0.8				1		1	Windows component
Windows StateRepository API	0.8				1		1	Windows component
Windows Storage	0.8			1	3		4	Windows component
Windows Storage Spaces Controller	0.8			3	3		6	Windows component
Windows Storport Miniport Driver	0.8				4		4	Windows component
Windows Subsystem for Linux	0.8				3		3	Windows component
Windows System Events Broker	0.8				1		1	Windows component
Windows TPM	0.8				1		1	Windows component
Windows Task Scheduler	0.8				6		6	Windows component
Windows Telephony Service	0.8				4		4	Windows component
Windows Text Services Framework	0.8				4		4	Windows component
Windows USB Audio Class driver (usbaudio.sys)	0.8				1		1	Windows component
Windows USB Driver	0.8				9		9	Windows component
Windows USB Hub Driver	0.8				3		3	Windows component
Windows USB Scanner Driver	0.8				1		1	Windows component
Windows USB Video Driver	0.8				4		4	Windows component
Windows USM Communication Manager	0.8				1		1	Windows component
Windows Universal Disk Format File System Driver (UDFS)	0.8				3		3	Windows component
Windows Update Stack	0.8				1		1	Windows component
Windows User Manager Service	0.8				2		2	Windows component
Windows Virtual Filtering Platform (VFP)	0.8			1			1	Windows component
Windows WLAN Service	0.8				1		1	Windows component
Windows WinHTTP	0.8				1		1	Windows component
Windows Wireless Networking	0.8				1		1	Windows component
Windows XWizard Framework	0.8				1		1	Windows component
Windows Xbox Live Networking Service	0.8			1			1	Windows component
Windows eSCL Scanner	0.8			1	1		2	Windows component
Windows exFAT File System	0.8				2		2	Windows component
Windows iSCSI	0.8			2	3		5	Windows component
Windows iSCSI Target Service	0.8				1		1	Windows component
.NET	0.7				6		6	.NET
HEVC Video Extensions	0.7			1	2		3	HEVC Video Extensions
Windows Feedback Hub	0.7				1		1	Feedback Hub is a universal app designed to allow users to provide feedback, feature suggestions, and bug reports for the operating system
Windows IKE Extension	0.7				1		1	Internet Key Exchange (IKE, sometimes IKEv1 or IKEv2, depending on version) is the protocol used to set up a security association (SA) in the IPsec protocol suite
Windows Mobile Device Management	0.7				1		1	Windows component
Windows Security Center	0.7				1		1	Windows Security Center (WSC) is a comprehensive reporting tool that helps users establish and maintain a protective security layer around their computer systems
DirectX	0.6				1		1	DirectX
HEIF Image Extensions	0.6				1		1	The HEIF Image Extension enables Windows 10 devices to read and write files that use the High Efficiency Image File (HEIF) format.
Microsoft Office Visio	0.6				2		2	Microsoft Visio
Microsoft Outlook	0.6		1				1	Microsoft Outlook is a personal information manager software system from Microsoft, available as a part of the Microsoft 365 software suites
Microsoft PowerPoint	0.6				2		2	Microsoft PowerPoint
Microsoft Word	0.6				4		4	Microsoft Word is a widely used commercial word processor developed by Microsoft. It is a component of the Microsoft Office suite of productivity software but can also be purchased as a standalone product.
Windows Hyper-V	0.6				16		16	Hardware virtualization component of the client editions of Windows NT
AMD Zen	0.5				2		2	AMD Zen
Active Directory Domain Services	0.5				3		3	Active Directory Domain Services
ActiveSyncProvider	0.5				1		1	ActiveSyncProvider
Aspire	0.5				4		4	Aspire
Azure CLI	0.5				1		1	Azure CLI
Azure Confidential Clean Rooms	0.5				1		1	Azure Confidential Clean Rooms
Azure CycleCloud	0.5				4		4	Azure CycleCloud
Azure DevOps Server	0.5				4		4	Azure DevOps Server
Azure Firmware	0.5				1		1	Azure Firmware
Azure Front Door	0.5				1		1	Azure Front Door
Azure Local	0.5				1		1	Azure Local
Azure Managed Grafana	0.5				1		1	Azure Managed Grafana
Azure NFS mount helper (aznfs)	0.5				1		1	Azure NFS mount helper (aznfs)
Azure OpenAI	0.5				1		1	Azure OpenAI
Azure Pipelines	0.5				1		1	Azure Pipelines
Connected Devices Platform Service (Cdpsvc)	0.5				1		1	Connected Devices Platform Service (Cdpsvc)
Data Deduplication	0.5				1		1	Data Deduplication
Data Sharing Service Client	0.5				1		1	Data Sharing Service Client
Desktop Window Manager	0.5				7		7	Desktop Window Manager
GitHub Copilot for Jetbrains	0.5				1		1	GitHub Copilot for Jetbrains
Graphic Fonts	0.5				3		3	Graphic Fonts
HID Parser Library	0.5				6		6	HID Parser Library
HID class driver	0.5				1		1	HID class driver
HTTP.sys	0.5				2		2	HTTP.sys
JDBC Driver for SQL Server	0.5				1		1	JDBC Driver for SQL Server
Mailslot File System	0.5				1		1	Mailslot File System
Microsoft 365 Agents SDK	0.5				1		1	Microsoft 365 Agents SDK
Microsoft Account	0.5				2		2	Microsoft Account
Microsoft ActiveX Installer Service	0.5				1		1	Microsoft ActiveX Installer Service
Microsoft Authentication Library (MSAL) for Node.js	0.5				1		1	Microsoft Authentication Library (MSAL) for Node.js
Microsoft Authentication Library for JavaScript	0.5				1		1	Microsoft Authentication Library for JavaScript
Microsoft Azure File Sync	0.5				1		1	Microsoft Azure File Sync
Microsoft Color Management	0.5				3		3	Microsoft Color Management
Microsoft Configuration Manager	0.5				1		1	Microsoft Configuration Manager
Microsoft DirectMusic	0.5				4		4	Microsoft DirectMusic
Microsoft Dynamics 365 (on-premises)	0.5				1		1	Microsoft Dynamics 365 (on-premises)
Microsoft Entra Private Network Connector	0.5				1		1	Microsoft Entra Private Network Connector
Microsoft Graph	0.5				1		1	Microsoft Graph
Microsoft Graphics Component	0.5				1		1	Microsoft Graphics Component
Microsoft High Performance Computing (HPC) Pack	0.5				1		1	Microsoft High Performance Computing (HPC) Pack
Microsoft Input Method Editor (IME)	0.5				1		1	Microsoft Input Method Editor (IME)
Microsoft JScript	0.5				1		1	Microsoft JScript
Microsoft MCP Gateway	0.5				1		1	Microsoft MCP Gateway
Microsoft ODBC Driver	0.5				1		1	Microsoft ODBC Driver
Microsoft Office Access	0.5				7		7	Microsoft Office Access
Microsoft Office Excel	0.5				64		64	Microsoft Office Excel
Microsoft Office Outlook	0.5				19		19	Microsoft Office Outlook
Microsoft Office PowerPoint	0.5				5		5	Microsoft Office PowerPoint
Microsoft Office SharePoint	0.5				26		26	Microsoft Office SharePoint
Microsoft Office Word	0.5				61		61	Microsoft Office Word
Microsoft QUIC	0.5				2		2	Microsoft QUIC
Microsoft Raw Image Extension	0.5				1		1	Microsoft Raw Image Extension
Microsoft Remote Registry Service	0.5				1		1	Microsoft Remote Registry Service
Microsoft SQL Server	0.5				50		50	Microsoft SQL Server
Microsoft SharePoint Server	0.5				1		1	Microsoft SharePoint Server
Microsoft Teams	0.5				1		1	Microsoft Teams
Microsoft Teams for Android	0.5				2		2	Microsoft Teams for Android
Microsoft Trace Data Helper	0.5				2		2	Microsoft Trace Data Helper
Microsoft WDAC OLE DB provider for SQL	0.5				5		5	Microsoft WDAC OLE DB provider for SQL
Microsoft XPS Document Converter	0.5				3		3	Microsoft XPS Document Converter
Microsoft Xbox	0.5				1		1	Microsoft Xbox
Microsoft.Data.SqlClient	0.5				1		1	Microsoft.Data.SqlClient
RPC Runtime	0.5				1		1	RPC Runtime
Reliable Multicast Transport Driver (RMCAST)	0.5				1		1	Reliable Multicast Transport Driver (RMCAST)
Remote Desktop Gateway Service	0.5				1		1	Remote Desktop Gateway Service
Remote Desktop Services Remote Code Execution Vulnerability	0.5				1		1	Remote Desktop Services Remote Code Execution Vulnerability
Remote Procedure Call	0.5				1		1	Remote Procedure Call
Role: DNS Server	0.5				2		2	Role: DNS Server
SQL Server	0.5				2		2	SQL Server
Secondary Logon	0.5				1		1	Secondary Logon
Servicing Stack Updates	0.5				1		1	Servicing Stack Updates
Software Protection Platform (SPP)	0.5				1		1	Software Protection Platform (SPP)
Storport.sys Driver	0.5				1		1	Storport.sys Driver
Virtual Hard Disk (VHD) Miniport Driver	0.5				1		1	Virtual Hard Disk (VHD) Miniport Driver
Volume Shadow Copy	0.5				2		2	Volume Shadow Copy
Winlogon	0.5				2		2	Winlogon
Winsock	0.5				2		2	Winsock
Xbox Gaming Services	0.5				1		1	Xbox Gaming Services
vhdmp.sys	0.5				1		1	vhdmp.sys
Microsoft Azure Kubernetes Service	0.3				1		1	Microsoft Azure Kubernetes Service
Visual Studio	0.3				5		5	Integrated development environment
Visual Studio Code	0.3				18		18	Integrated development environment
Visual Studio Code GitHub Pull Requests and Issues Extension	0.2				1		1	Extension for Visual Studio Code IDE

Vulnerability Type	Criticality	U	C	H	M	L	A
Remote Code Execution	1.0			82	214		296
Security Feature Bypass	0.9			1	27		28
Elevation of Privilege	0.85			4	530		534
Information Disclosure	0.83				156		156
Denial of Service	0.7				46		46
Spoofing	0.4		1		21		22
Tampering	0.3				11		11

Source	U	C	H	M	L	A
Qualys		1				1
Rapid7		1	2			3
ZDI		1	18	7		26
Tenable		1	3	1		5

Urgent (0)

Critical (1)

1. Spoofing - Microsoft Outlook (CVE-2026-124194) - Critical [671]

Description: Microsoft Outlook Spoofing Vulnerability

Qualys: CVE-2026-124194: Microsoft Outlook Spoofing Vulnerability  An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file may cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning. Successful exploitation of the vulnerability may lead to disclosure of authentication information that could be used to impersonate the user. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog, urging users to patch it before November 24, 2026. 

Rapid7: Imagine coming home and checking your mailbox to find a postcard. You admire the non-specific image of a tropical beach at sunset, and flip it over to scan the handwriting on the back, which looks vaguely familiar. It’s addressed to you, but you can’t make out the signature, and the message is short and generic. Is that real handwriting, or has this been printed? Probably marketing material. You put the card in the recycling and, since life is busy, you move on and forget about it. Somehow, you remain entirely unaware that, immediately after reading the postcard, you took out your phone and sent high-resolution images of your front door key to a number you’ve never contacted before. Is this sketch just some rather questionable science fiction? Yes, hopefully, but what if that non-specific postcard was instead a malicious file in your Outlook inbox? Now we’re talking about CVE-2026-124194, an exploited-in-the-wild spoofing vulnerability. Merely opening a specially crafted malicious file causes Outlook to silently connect to an attacker-controlled location and leak the user’s NTLM v2 hash. All supported versions of classic Outlook receive patches. The relatively low CVSS v3.1 base score of 6.5 does not tell the full story here, since this vulnerability provides value for both commodity attackers working to harvest initial access at scale, and also more targeted campaigns by more sophisticated threat actors. The NTLM v2 hash can be relayed live to impersonate the user against another service, at least where those services do not implement adequate safeguards such as message signing for SMB or LDAP, as well as Extended Protection for Authentication for Exchange or Active Directory Certificate Services. Alternatively, the NTLM v2 hash can be cracked offline by a motivated attacker to retrieve the underlying credential. The Preview Pane is not a vector, which will help limit the real-world impact somewhat.

ZDI: -              CVE-2026-124194 - Microsoft Outlook Spoofing Vulnerability. This is the one bug under active attack this month. It’s labeled spoofing, but the impact is bigger than the name suggests. An attacker sends a specially crafted message file and convinces a user to open it. Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user’s NTLMv2 hash. The attacker can use that hash to authenticate as the user. The Preview Pane is not an attack vector, and the CVSS is only 6.5, so don’t let the score lull you. Microsoft marks it as exploited, so this one goes to the top of the list.

Tenable: CVE-2026-124194 | Microsoft Outlook spoofing vulnerability

Tenable: CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook. It received a CVSSv3 score of 6.5 and is rated moderate. An attacker could exploit this vulnerability by convincing a target to open a crafted Microsoft Office file. Successful exploitation would allow an attacker to obtain the target’s valid NTLMv2 hash, which can then be used to impersonate that user in follow-on attacks.

High (87)

2. Elevation of Privilege - Microsoft Windows App Store (CVE-2026-119987) - High [582]

Description: Microsoft Windows App Store Elevation of Privilege Vulnerability

3. Elevation of Privilege - Windows AppX Deployment Service (CVE-2026-116714) - High [582]

Description: Windows AppX Deployment Service Elevation of Privilege Vulnerability

4. Remote Code Execution - Microsoft Windows Media Foundation (CVE-2026-96157) - High [430]

Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

ZDI: Last month saw 59 bugs that fit this definition. This month, it’s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing. These bugs are as follows: Message Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967 . DNS (4): CVE-2026-81384, 96092, 96177, 88218 . Two each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801) . One each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945) . I may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange

5. Remote Code Execution - Windows DHCP Server (CVE-2026-88243) - High [430]

Description: Windows DHCP Server Remote Code Execution Vulnerability

ZDI: Last month saw 59 bugs that fit this definition. This month, it’s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing. These bugs are as follows: Message Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967 . DNS (4): CVE-2026-81384, 96092, 96177, 88218 . Two each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801) . One each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945) . I may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange

6. Remote Code Execution - Windows DNS (CVE-2026-88218) - High [430]

Description: Windows DNS Remote Code Execution Vulnerability

7. Remote Code Execution - Windows LDAP - Lightweight Directory Access Protocol (CVE-2026-119958) - High [430]

Description: Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability

ZDI: -              CVE-2026-119958 - Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability. This patch addresses a bug that allows an unauthenticated attacker to exploit an out-of-bounds (OOB) write (CWE-787) by sending crafted LDAP calls over the network, with no user interaction. Since it runs code in the LDAP service context, it could be quite destructive, especially on Domain Controllers. Test and deploy this one quickly.

ZDI: Last month saw 59 bugs that fit this definition. This month, it’s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing. These bugs are as follows: Message Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967 . DNS (4): CVE-2026-81384, 96092, 96177, 88218 . Two each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801) . One each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945) . I may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange

8. Remote Code Execution - Windows Search (CVE-2026-116928) - High [430]

Description: Windows Search Remote Code Execution Vulnerability

Rapid7: Could someone take control of your Exchange server by sending a single email? In short: yes. Microsoft offers customers tight integration between various business-critical components. Exchange running on Windows is Microsoft on Microsoft, and the Windows Search component indexes email on behalf of Exchange. An attacker aiming to exploit CVE-2026-116928 relies on this helpful synergy to achieve pre-auth RCE on the server by sending a malicious attachment, which Exchange will process automatically. How’s that for low attack complexity? Although the advisory does not specify the context of execution, we should assume SYSTEM, since several of the services which might be involved do run with a high privilege level. Since the patches are for Windows OS rather than Exchange itself, there’s no need to worry about which version of Exchange you’re running, so long as you are running only Exchange Subscription Edition, since all previous versions of Exchange are now fully beyond end of support.

ZDI: -              CVE-2026-116928 - Windows Search Remote Code Execution Vulnerability. We start with Windows Search, which is reached through Exchange Server. This bug allows an unauthenticated attacker to send an email with a specially crafted attachment that triggers the bug when the server automatically indexes it. The recipient never opens anything. It is a zero-click code execution bug on a high-value target. It’s also a CVSS 9.8 and clearly more severe than any of the nine patches Exchange receives this month.

ZDI: Last month saw 59 bugs that fit this definition. This month, it’s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing. These bugs are as follows: Message Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967 . DNS (4): CVE-2026-81384, 96092, 96177, 88218 . Two each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801) . One each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945) . I may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange

9. Remote Code Execution - Windows Xbox Live Networking Service (CVE-2026-112967) - High [430]

Description: Windows Xbox Live Networking Service Remote Code Execution Vulnerability

ZDI: -              CVE-2026-112967 - Windows Xbox Live Networking Service Remote Code Execution Vulnerability. You don’t see a lot of Xbox Live bugs, but here we are with a CVSS 9.8.  This bug is a heap overflow that doesn’t need authentication or user interaction. Microsoft states the attacker can “gain remote code execution via an in-network attacker calling arbitrary endpoints.” Is this really likely? Probably not, but it’s fun to think of Xbox Live exploits in the wild.

ZDI: Last month saw 59 bugs that fit this definition. This month, it’s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing. These bugs are as follows: Message Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967 . DNS (4): CVE-2026-81384, 96092, 96177, 88218 . Two each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801) . One each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945) . I may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange

10. Remote Code Execution - Windows iSCSI (CVE-2026-88234) - High [430]

Description: Windows iSCSI Remote Code Execution Vulnerability

ZDI: Last month saw 59 bugs that fit this definition. This month, it’s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing. These bugs are as follows: Message Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967 . DNS (4): CVE-2026-81384, 96092, 96177, 88218 . Two each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801) . One each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945) . I may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange

11. Remote Code Execution - Windows DNS Server (CVE-2026-81384) - High [423]

Description: Windows DNS Server Remote Code Execution Vulnerability

ZDI: Last month saw 59 bugs that fit this definition. This month, it’s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing. These bugs are as follows: Message Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967 . DNS (4): CVE-2026-81384, 96092, 96177, 88218 . Two each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801) . One each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945) . I may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange

12. Remote Code Execution - Windows TCP/IP (CVE-2026-113859) - High [423]

Description: Windows TCP/IP Remote Code Execution Vulnerability

13. Remote Code Execution - Microsoft Defender (CVE-2026-122194) - High [419]

Description: Microsoft Defender Remote Code Execution Vulnerability

14. Remote Code Execution - Microsoft Exchange (CVE-2026-118149) - High [419]

Description: Microsoft Exchange Server Remote Code Execution Vulnerability

15. Remote Code Execution - Microsoft Exchange (CVE-2026-118207) - High [419]

Description: Microsoft Exchange Server Remote Code Execution Vulnerability

Tenable: CVE-2026-118207 | Microsoft Exchange Server remote code execution vulnerability

Tenable: CVE-2026-118207 is an RCE vulnerability affecting Microsoft Exchange Server. It received a CVSSv3 score of 8.8 and is rated as critical. An authenticated attacker could send malformed input to Microsoft Exchange Server, causing code to execute over a network. Successful exploitation would allow an attacker to execute arbitrary code on the affected system. It was assessed as “Exploitation More Likely.”

16. Remote Code Execution - Microsoft Office (CVE-2026-111289) - High [419]

Description: Microsoft Office Remote Code Execution Vulnerability

17. Remote Code Execution - Microsoft Office (CVE-2026-116717) - High [419]

Description: Microsoft Office Remote Code Execution Vulnerability

18. Remote Code Execution - Microsoft Office (CVE-2026-120003) - High [419]

Description: Microsoft Office Remote Code Execution Vulnerability

19. Remote Code Execution - Microsoft Office (CVE-2026-122198) - High [419]

Description: Microsoft Office Remote Code Execution Vulnerability

20. Remote Code Execution - Windows Domain Name Service (CVE-2026-112727) - High [419]

Description: Windows Domain Name Service Remote Code Execution Vulnerability

21. Remote Code Execution - Windows Domain Name Service (CVE-2026-96002) - High [419]

Description: Windows Domain Name Service Remote Code Execution Vulnerability

22. Remote Code Execution - Windows Domain Name Service (CVE-2026-96020) - High [419]

Description: Windows Domain Name Service Remote Code Execution Vulnerability

23. Remote Code Execution - Windows Domain Name Service (CVE-2026-96064) - High [419]

Description: Windows Domain Name Service Remote Code Execution Vulnerability

24. Remote Code Execution - Windows Active Directory Domain Services (CVE-2026-118146) - High [419]

Description: Windows Active Directory Domain Services Remote Code Execution Vulnerability

Tenable: CVE-2026-118146 | Windows Active Directory Domain Services remote code execution vulnerability

Tenable: CVE-2026-118146 is an RCE vulnerability affecting Windows Active Directory Domain Services. It received a CVSSv3 score of 8.8 and is rated as critical. An authenticated attacker could exploit an incorrect authorization in Active Directory Domain Services to execute code over a network. Successful exploitation would allow an attacker to execute arbitrary code on the affected system. It was assessed as “Exploitation More Likely.”

25. Remote Code Execution - Windows Client for NFS (CVE-2026-118141) - High [419]

Description: Windows Client for NFS Remote Code Execution Vulnerability

26. Remote Code Execution - Windows Client for NFS (CVE-2026-88249) - High [419]

Description: Windows Client for NFS Remote Code Execution Vulnerability

27. Remote Code Execution - Windows DNS (CVE-2026-109463) - High [419]

Description: Windows DNS Remote Code Execution Vulnerability

28. Remote Code Execution - Windows Imaging Component (CVE-2026-96164) - High [419]

Description: Windows Imaging Component Remote Code Execution Vulnerability

29. Remote Code Execution - Windows Media Player (CVE-2026-88229) - High [419]

Description: Windows Media Player Remote Code Execution Vulnerability

30. Remote Code Execution - Windows NTFS (CVE-2026-105542) - High [419]

Description: Windows NTFS Remote Code Execution Vulnerability

31. Remote Code Execution - Windows Network Connected Devices Auto-Setup Service (CVE-2026-125136) - High [419]

Description: Windows Network Connected Devices Auto-Setup Service Remote Code Execution Vulnerability

32. Remote Code Execution - Windows Performance Counters (CVE-2026-95975) - High [419]

Description: Windows Performance Counters Remote Code Execution Vulnerability

33. Remote Code Execution - Windows Raw Image Extension (CVE-2026-114169) - High [419]

Description: Windows Raw Image Extension Remote Code Execution Vulnerability

34. Remote Code Execution - Windows Remote Desktop Client (CVE-2026-119934) - High [419]

Description: Remote Desktop Client Remote Code Execution Vulnerability

35. Remote Code Execution - Windows SMB (CVE-2026-122176) - High [419]

Description: Windows SMB Remote Code Execution Vulnerability

36. Remote Code Execution - Windows Storage (CVE-2026-105534) - High [419]

Description: Windows Storage Remote Code Execution Vulnerability

37. Remote Code Execution - Windows Storage Spaces Controller (CVE-2026-113814) - High [419]

Description: Windows Storage Spaces Controller Remote Code Execution Vulnerability

38. Remote Code Execution - Windows Storage Spaces Controller (CVE-2026-119908) - High [419]

Description: Windows Storage Spaces Controller Remote Code Execution Vulnerability

39. Remote Code Execution - Windows Storage Spaces Controller (CVE-2026-122475) - High [419]

Description: Windows Storage Spaces Controller Remote Code Execution Vulnerability

40. Remote Code Execution - Windows Virtual Filtering Platform (VFP) (CVE-2026-95962) - High [419]

Description: Windows Virtual Filtering Platform (VFP) Remote Code Execution Vulnerability

ZDI: -              CVE-2026-95962 - Windows Virtual Filtering Platform (VFP) Remote Code Execution Vulnerability. I include this one because it’s in a little-documented component. It’s not the first CVE in VFP, but it appears to be just the second. It’s a use-after-free that allows an unauthenticated attacker to get code execution on affected targets by sending a specially crafted packet to the affected service over the network. No authentication or user interaction is needed. There is a race condition here, but we see those overcome all the time at Pwn2Own. This should be an interesting component to watch.

ZDI: Last month saw 59 bugs that fit this definition. This month, it’s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing. These bugs are as follows: Message Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967 . DNS (4): CVE-2026-81384, 96092, 96177, 88218 . Two each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801) . One each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945) . I may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange

41. Remote Code Execution - Windows iSCSI (CVE-2026-105518) - High [419]

Description: Windows iSCSI Remote Code Execution Vulnerability

42. Elevation of Privilege - Windows Kernel (CVE-2026-112805) - High [408]

Description: Windows Kernel Elevation of Privilege Vulnerability

43. Remote Code Execution - Microsoft Office (CVE-2026-111286) - High [407]

Description: Microsoft Office Remote Code Execution Vulnerability

44. Remote Code Execution - Microsoft Windows Codecs Library (CVE-2026-113749) - High [407]

Description: Microsoft Windows Codecs Library Remote Code Execution Vulnerability

45. Remote Code Execution - RPC (CVE-2026-118737) - High [407]

Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability

ZDI: Last month saw 59 bugs that fit this definition. This month, it’s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing. These bugs are as follows: Message Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967 . DNS (4): CVE-2026-81384, 96092, 96177, 88218 . Two each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801) . One each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945) . I may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange

46. Remote Code Execution - Windows Domain Name Service (CVE-2026-96092) - High [407]

Description: Windows Domain Name Service Remote Code Execution Vulnerability

47. Remote Code Execution - Windows Domain Name Service (CVE-2026-96177) - High [407]

Description: Windows Domain Name Service Remote Code Execution Vulnerability

48. Remote Code Execution - Windows Active Directory (CVE-2026-119948) - High [407]

Description: Windows Active Directory Remote Code Execution Vulnerability

49. Remote Code Execution - Windows CredSSP (CVE-2026-119962) - High [407]

Description: Windows CredSSP Remote Code Execution Vulnerability

ZDI: Last month saw 59 bugs that fit this definition. This month, it’s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing. These bugs are as follows: Message Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967 . DNS (4): CVE-2026-81384, 96092, 96177, 88218 . Two each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801) . One each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945) . I may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange

50. Remote Code Execution - Windows DHCP Server (CVE-2026-72998) - High [407]

Description: Windows DHCP Server Remote Code Execution Vulnerability

51. Remote Code Execution - Windows DHCP Server (CVE-2026-88216) - High [407]

Description: Windows DHCP Server Remote Code Execution Vulnerability

52. Remote Code Execution - Windows DNS (CVE-2026-113855) - High [407]

Description: Windows DNS Remote Code Execution Vulnerability

53. Remote Code Execution - Windows Deployment Services (CVE-2026-105558) - High [407]

Description: Windows Deployment Services Remote Code Execution Vulnerability

54. Remote Code Execution - Windows Deployment Services (CVE-2026-119951) - High [407]

Description: Windows Deployment Services Remote Code Execution Vulnerability

ZDI: Last month saw 59 bugs that fit this definition. This month, it’s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing. These bugs are as follows: Message Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967 . DNS (4): CVE-2026-81384, 96092, 96177, 88218 . Two each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801) . One each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945) . I may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange

55. Remote Code Execution - Windows Function Discovery Resource Publication (CVE-2026-125134) - High [407]

Description: Windows Function Discovery Resource Publication Remote Code Execution Vulnerability

56. Remote Code Execution - Windows Function Discovery SSDP Provider (CVE-2026-118145) - High [407]

Description: Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability

57. Remote Code Execution - Windows Image Acquisition (CVE-2026-122163) - High [407]

Description: Windows Image Acquisition Remote Code Execution Vulnerability

58. Remote Code Execution - Windows Internet Information Services (CVE-2026-119961) - High [407]

Description: Windows Internet Information Services Remote Code Execution Vulnerability

ZDI: Last month saw 59 bugs that fit this definition. This month, it’s a bit less. A total of 30 of the November CVEs fit my definition of wormable. Specifically, 17 contain the advisory language describing an unauthenticated attacker executing code over the network with no authentication or user interaction required. The other 13 use variant wording or have no FAQ, but their summaries and CVSS vectors (AV:N/PR:N/UI:N) describe the same thing. These bugs are as follows: Message Queuing (5): CVE-2026-116710, 119963, 119964, 109459, 119967 . DNS (4): CVE-2026-81384, 96092, 96177, 88218 . Two each (8): Color Management (CVE-2026-96067, 96078), DHCP Server (CVE-2026-88243, 72998), DirectMusic (CVE-2026-95882, 95901) and Xbox (CVE-2026-112967, 66801) . One each (13): Exchange Server (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), CredSSP (CVE-2026-119962), Deployment Services (CVE-2026-119951), IIS (CVE-2026-119961), NAT (CVE-2026-113862), RPC Runtime (CVE-2026-118737), Media Foundation (CVE-2026-96157), iSCSI (CVE-2026-88234), Virtual Filtering Platform (CVE-2026-95962), eSCL Scanner (CVE-2026-95956) and Modern Device Management (CVE-2026-119945) . I may be wrong about some of these, since a few advisories are light on detail. As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange

59. Remote Code Execution - Windows JScript (CVE-2026-112985) - High [407]

Description: Windows JScript Remote Code Execution Vulnerability

60. Remote Code Execution - Windows Link Layer Topology Discovery Protocol (CVE-2026-116706) - High [407]

Description: Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability