Patch Tuesday Dashboard

Assurance Security Dashboard: November 2026 Patch Tuesday

By ·

November 2026 Assurance Security Dashboard infographic: 1,240 CVEs across Windows, Browsers, Development, Office, Exchange and SQL Server, with 64 Critical and one exploited zero-day

Microsoft’s November 2026 Patch Tuesday addresses 1,240 CVEs that need customer action, and 64 of them are rated Critical. The infographic above summarises severity and risk level by product family. One CVE is under active exploitation. None was publicly disclosed before release.

Microsoft’s release note lists 1,094 Microsoft CVEs; this dashboard leaves out 19 Azure and open-source entries and adds the 165 Chromium fixes that Microsoft republishes for Edge, which gives 1,240.

On the same basis, October counted 1,408 CVEs with 71 rated Critical. October carried no Chromium entries, so the like-for-like November figure is 1,075.

November 2026 Patch Tuesday: updates by product family

  • Windows - 37 Critical, 708 Important, top CVSS 9.8. Action: Patch Now.
  • Browsers - 4 Critical, 80 Important, 48 Moderate, 34 Low, top CVSS 9.6. Action: Patch Now.
  • Development - 50 Important, top CVSS 9.9. Action: Schedule.
  • Office - 22 Critical, 181 Important, 1 Moderate, top CVSS 9.9. Action: Patch Now.
  • Exchange - 1 Critical, 8 Important, top CVSS 8.8. Action: Patch Now.
  • SQL Server - 54 Important, top CVSS 9.8. Action: Schedule.

All six families have updates this month, so no family shows the quiet-month glass.

Notable CVEs this cycle

  • CVE-2026-124194 (Office) - Microsoft Outlook Spoofing Vulnerability. Exploited, rated Moderate.

The only exploited CVE this month is rated Moderate, not Critical. Treat the exploit flag, not the severity label, as the reason to move Outlook to the front of the queue.

Patch Now: Windows, Browsers, Office, Exchange. Critical-rated or actively exploited vulnerabilities drive these into the immediate-action queue.

Schedule: Development, SQL Server. Neither has a Critical-rated CVE this month. Roll them into the regular monthly update cycle.

Every patch, every platform change, every application update is a risk-based decision under uncertainty. Readiness Assurance turns that uncertainty into prescriptive guidance - where applications are scanned, tested, documented, and delivered with certainty into production.

#patch-tuesday#msrc#windows-security#assurance-security-dashboard