Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for November 2026, which includes 1095 vulnerabilities affecting a range of products, including 64 that Microsoft marked as "critical."

Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild

CVE-2026-124194 affects Microsoft Office Outlook. CVE-2026-124194 is a spoofing vulnerability involving Product UI does not Warn User of Unsafe Actions and has a CVSS base score of 6.5.

Out of 64 "critical" vulnerabilities, 48 are remote code execution (RCE) vulnerabilities.

Microsoft considers exploitation of the following vulnerabilities more likely:

CVE-2026-113862 affects Windows Network Address Translation (NAT). CVE-2026-113862 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.1.

CVE-2026-118146 and CVE-2026-118148 affect Active Directory Domain Services. CVE-2026-118146 is a remote code execution vulnerability involving Incorrect Authorization and has a CVSS base score of 8.8. CVE-2026-118148 is an elevation of privilege vulnerability involving Incorrect Authorization and has a CVSS base score of 7.5.

CVE-2026-118207 affects Microsoft Exchange Server. CVE-2026-118207 is a remote code execution vulnerability involving Use of Incorrectly-Resolved Name or Reference and has a CVSS base score of 8.8.

CVE-2026-119952 affects Windows Schannel. CVE-2026-119952 is a remote code execution vulnerability involving Observable Timing Discrepancy and has a CVSS base score of 8.1.

Microsoft considers exploitation of the following vulnerabilities less likely:

CVE-2026-109459 and CVE-2026-119967 affect Windows Message Queuing Queue Manager. CVE-2026-109459 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.1. CVE-2026-119967 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.1.

CVE-2026-110043, CVE-2026-110068 and CVE-2026-111309 affect Microsoft Office Outlook. CVE-2026-110043 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-110068 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-111309 is a remote code execution vulnerability involving Release of Invalid Pointer or Reference and has a CVSS base score of 8.8.

CVE-2026-110047, CVE-2026-110067, CVE-2026-111285 and CVE-2026-124185 affect Microsoft Office Word. CVE-2026-110047 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-110067 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-111285 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-124185 is a remote code execution vulnerability involving Use of Uninitialized Resource and has a CVSS base score of 7.5.

CVE-2026-111289 and CVE-2026-120003 affect Microsoft Office. CVE-2026-111289 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-120003 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.

CVE-2026-112967 affects Windows Xbox Live Networking Service. CVE-2026-112967 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 9.8.

CVE-2026-113752 affects Windows Print Spooler Components. CVE-2026-113752 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5.

CVE-2026-113753, CVE-2026-113856, CVE-2026-113860, CVE-2026-113861, CVE-2026-113865, CVE-2026-119947, CVE-2026-119960 and CVE-2026-113864 affect Windows Hyper-V. CVE-2026-113753 is an elevation of privilege vulnerability involving Untrusted Pointer Dereference and has a CVSS base score of 8.2. CVE-2026-113856 is an elevation of privilege vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 7.8. CVE-2026-113860 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 7.0. CVE-2026-113861 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 7.5. CVE-2026-113865 is an elevation of privilege vulnerability involving Time-of-check Time-of-use (TOCTOU) Race Condition and has a CVSS base score of 7.8. CVE-2026-119947 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 7.5. CVE-2026-119960 is an elevation of privilege vulnerability involving Use of Uninitialized Resource and has a CVSS base score of 7.5. CVE-2026-113864 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 6.4.

CVE-2026-113825 affects Windows SMB Server Network Transport Driver (srvnet.sys). CVE-2026-113825 is a remote code execution vulnerability involving Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and has a CVSS base score of 7.5.

CVE-2026-113859 affects Windows TCP/IP. CVE-2026-113859 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5.

CVE-2026-114160 affects Azure Managed Grafana. CVE-2026-114160 is an elevation of privilege vulnerability involving Server-Side Request Forgery (SSRF) and has a CVSS base score of 9.8.

CVE-2026-114169 affects Windows Raw Image Extension. CVE-2026-114169 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.

CVE-2026-116710, CVE-2026-119963 and CVE-2026-119964 affect Windows Message Queuing. CVE-2026-116710 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.1. CVE-2026-119963 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.1. CVE-2026-119964 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.1.

CVE-2026-116928 affects Microsoft Windows Search Component. CVE-2026-116928 is a remote code execution vulnerability involving Out-of-bounds Write and has a CVSS base score of 9.8.

CVE-2026-118145 affects Windows Function Discovery SSDP Provider. CVE-2026-118145 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5.

CVE-2026-118292, CVE-2026-118296, CVE-2026-118297, CVE-2026-118701, CVE-2026-118702, CVE-2026-118711, CVE-2026-118713, CVE-2026-118730, CVE-2026-120786, CVE-2026-120788, CVE-2026-120789 and CVE-2026-124170 affect Microsoft Office Excel. CVE-2026-118292 is a remote code execution vulnerability involving Stack-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118296 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.8. CVE-2026-118297 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118701 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118702 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.8. CVE-2026-118711 is a remote code execution vulnerability involving Stack-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118713 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-118730 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-120786 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-120788 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-120789 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-124170 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 7.5.

CVE-2026-118737 affects Windows Remote Procedure Call Runtime. CVE-2026-118737 is a remote code execution vulnerability involving Improper Verification of Cryptographic Signature and has a CVSS base score of 8.1.

CVE-2026-119382 affects Windows TPM. CVE-2026-119382 is an elevation of privilege vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 7.8.

CVE-2026-119951 affects Windows Deployment Services. CVE-2026-119951 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.1.

CVE-2026-119957 affects Windows Remote Desktop Services. CVE-2026-119957 is an elevation of privilege vulnerability involving Double Free and has a CVSS base score of 7.8.

CVE-2026-119958 affects Windows LDAP - Lightweight Directory Access Protocol. CVE-2026-119958 is a remote code execution vulnerability involving Out-of-bounds Write and has a CVSS base score of 9.8.

CVE-2026-119961 affects Windows Internet Information Services. CVE-2026-119961 is a remote code execution vulnerability involving Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free and has a CVSS base score of 8.1.

CVE-2026-119962 affects Windows Cred SSProvider Protocol. CVE-2026-119962 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.1.

CVE-2026-119966 and CVE-2026-125137 affect Windows Graphics Kernel. CVE-2026-119966 is an elevation of privilege vulnerability involving Integer Overflow or Wraparound and has a CVSS base score of 7.5. CVE-2026-125137 is an elevation of privilege vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 7.8.

CVE-2026-119969 affects Graphic Fonts. CVE-2026-119969 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.

CVE-2026-120005 affects Microsoft Office PowerPoint. CVE-2026-120005 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.

CVE-2026-122194 affects Microsoft Defender. CVE-2026-122194 is a remote code execution vulnerability involving NULL Pointer Dereference and has a CVSS base score of 8.8.

CVE-2026-125136 affects Windows Network Connected Devices Auto-Setup Service. CVE-2026-125136 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.

CVE-2026-125134 affects Windows Function Discovery Resource Publication. CVE-2026-125134 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5.

CVE-2026-113749 affects Microsoft Windows Codecs Library. CVE-2026-113749 is a remote code execution vulnerability involving Heap-based Buffer Overflow and Integer Overflow or Wraparound and has a CVSS base score of 7.5.

CVE-2026-109469 affects Entra Device Registration. CVE-2026-109469 is an elevation of privilege vulnerability involving Authorization Bypass Through User-Controlled Key and has a CVSS base score of 10.0.

Other critical vulnerabilities:

CVE-2026-119990 affects Azure OpenAI. CVE-2026-119990 is an elevation of privilege vulnerability involving Missing Authentication for Critical Function and has a CVSS base score of 9.8.

Talos would also like to highlight the following "important" vulnerabilities as Microsoft has determined that their exploitation is "more likely:"

CVE-2026-105501: Windows Installer Elevation of Privilege Vulnerability

CVE-2026-105524: Windows Management Instrumentation Elevation of Privilege Vulnerability

CVE-2026-109473: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-112745: Azure DevOps Server Information Disclosure Vulnerability

CVE-2026-112759: Windows Task Scheduler Elevation of Privilege Vulnerability

CVE-2026-112791: Windows Print Spooler Components Elevation of Privilege Vulnerability

CVE-2026-112798: Windows NetBIOS Elevation of Privilege Vulnerability

CVE-2026-112811: Windows Print Spooler Components Elevation of Privilege Vulnerability

CVE-2026-112970: Windows SMB Client Elevation of Privilege Vulnerability

CVE-2026-113819: Desktop Window Manager Elevation of Privilege Vulnerability

CVE-2026-116714: Windows AppX Deployment Service Elevation of Privilege Vulnerability

CVE-2026-119389: Windows Storage Elevation of Privilege Vulnerability

CVE-2026-119398: Windows Installer Elevation of Privilege Vulnerability

CVE-2026-119818: Windows Text Services Framework Elevation of Privilege Vulnerability

CVE-2026-119886: Windows Telephony Service Elevation of Privilege Vulnerability

CVE-2026-119892: Windows Installer Elevation of Privilege Vulnerability

CVE-2026-119903: Windows Installer Elevation of Privilege Vulnerability

CVE-2026-119992: Windows HTTP.sys Elevation of Privilege Vulnerability

CVE-2026-121662: Visual Studio Code Remote Code Execution Vulnerability

CVE-2026-121663: Visual Studio Code Security Feature Bypass Vulnerability

CVE-2026-122175: Windows Autopilot Elevation of Privilege Vulnerability

CVE-2026-83563: Winlogon Elevation of Privilege Vulnerability

CVE-2026-88230: Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability

CVE-2026-88238: Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability

CVE-2026-88242: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2026-94514: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-95874: Xbox Gaming Services Elevation of Privilege Vulnerability

CVE-2026-95935: Windows Graphics Kernel Elevation of Privilege Vulnerability

CVE-2026-95963: Data Sharing Service Client Elevation of Privilege Vulnerability

CVE-2026-95983: Windows Graphics Kernel Elevation of Privilege Vulnerability

CVE-2026-95988: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-95989: vhdmp.sys Elevation of Privilege Vulnerability

CVE-2026-96077: Windows TCP/IP Denial of Service Vulnerability

CVE-2026-96126: Windows Graphics Kernel Elevation of Privilege Vulnerability

CVE-2026-97013: Windows Shell Elevation of Privilege Vulnerability

CVE-2026-119853: Remote Access API Elevation of Privilege Vulnerability

CVE-2026-88235: Servicing Stack Updates Elevation of Privilege Vulnerability

A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.

In response to these vulnerability disclosures, Talos is releasing a new Snort ruleset that detects attempts to exploit some of them. Please note that additional rules may be released at a future date, and current rules are subject to change pending additional information. Cisco Secure Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Ruleset customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

Snort 2 rule coverage: 1:67457, 1:67456, 1:67459, 1:67458, 1:67463, 1:67462, 1:67461, 1:67460, 1:67455, 1:67454, 116:96, 116:97, 1:67445, 1:67444, 1:67451, 1:67450, 1:67447, 1:67446, 1:67449, 1:67448, 1:67469, 1:67468, 1:67465, 1:67464, 1:67471, 1:67470, 1:67475, 1:67474, 1:67473, 1:67472, 1:67484, 1:67483, 1:67254, 1:67255

Snort 3 rule coverage: 1:301740, 1:301741, 1:301743, 1:301742, 1:301739, 116:96, 116:97, 1:301734, 1:301737, 1:301735, 1:301736, 1:301746, 1:301744, 1:301747, 1:301749, 1:301748, 1:301751, 1:301685