M365 Security | November 2026 Patch Tuesday

On November 10, 2026, Microsoft released the November security updates.

For Microsoft 365 environments, two entries stand out: an already exploited spoofing vulnerability in Office and a critical remote code execution vulnerability in Exchange Server Subscription Edition. Additionally, there is a Windows vulnerability with a CVSS score of 9.8, which, according to the Zero Day Initiative (ZDI), can also be exploited via Exchange.

Microsoft classifies CVE-2026-124194 as a spoofing vulnerability with a "Moderate" severity rating and a CVSS base score of 6.5. The attack vector is AV:N/AC:L/PR:N/UI:R, with a high impact on confidentiality. This means the attacker requires no privileges but does need user interaction. Microsoft attributes the cause to CWE-356, an interface that fails to warn against an unsafe action.

According to ZDI, Microsoft marks the vulnerability as exploited, making it the only exploited vulnerability of this Patch Tuesday. ZDI describes the process as follows: A crafted message file causes Outlook to establish a connection to an attacker-controlled destination, thereby leaking the user's NTLMv2 hash. The preview pane is reportedly not an attack vector, per ZDI.

Affected according to the Security Update Guide:

For Microsoft 365 Apps, protection depends on the update channel. Therefore, check whether your clients have reached the security build for their channel.

This month, ZDI lists nine CVEs for Exchange Server. The most severe is CVE-2026-118207, a remote code execution vulnerability rated "Critical" with a CVSS score of 8.8. The vector AV:N/AC:L/PR:L/UI:N indicates that an attacker requires low-privilege access but no user interaction. ZDI classifies this vulnerability as wormable this month.

Microsoft refers to the update for Exchange Server Subscription Edition RTM as KB5133453 with build 15.02.2562.057. A restart is required after installation. According to ZDI, the remaining eight Exchange CVEs include another RCE (CVE-2026-118149), four elevation of privilege vulnerabilities, one denial-of-service vulnerability, and two spoofing vulnerabilities.

CVE-2026-116928 is a Windows out-of-bounds write vulnerability with a CVSS score of 9.8. The vector AV:N/AC:L/PR:N/UI:N means: no authentication, no user interaction. ZDI assigns the vulnerability to Windows Search and describes that it can be reached via Exchange Server: a mail attachment that the server indexes is sufficient without any click.

For an Exchange Server, the Exchange update alone is not sufficient. The Windows updates must be included in the same maintenance window: