Which Microsoft November 2026 Patch Tuesday issues should you fix first?

This page covers two remote code execution issues in Microsoft's November 2026 Security Updates (release 2026-Nov) that Microsoft rates Critical. Microsoft is the CNA for both. CVE-2026-119958 in Windows LDAP is Microsoft Critical, CVSS 3.1 base score 9.8. CVE-2026-119952 in Windows Schannel is Microsoft Critical, CVSS 8.1 (the cve.org record labels that 8.1 as HIGH; we follow Microsoft's Critical rating). Microsoft marks both as not exploited and not publicly disclosed before today. Microsoft's November release note covers a much larger set of CVEs; this page is not a full list of that release.

CVE-2026-119958 is a Windows LDAP (Lightweight Directory Access Protocol) remote code execution vulnerability. Microsoft is the CNA. Microsoft describes an out-of-bounds write that allows an unauthorized attacker to execute code over a network. Microsoft's FAQ says an unauthenticated attacker who exploited it could gain code execution through a specially crafted set of LDAP calls, and that the code would run in the context of the LDAP service. Microsoft rates it Critical, CVSS 3.1 base score 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. There is no authentication and no user interaction. Microsoft marks it as not exploited, not publicly disclosed before 10 November 2026, and rates exploitation of the latest software release as Less Likely. It was not in CISA's Known Exploited Vulnerabilities catalogue when we rechecked at 19:15 GMT on 10 November 2026 (catalogue 2026.11.10).

For both CVE-2026-119958 and CVE-2026-119952, the Microsoft Security Response Centre affected-product list is: Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2; and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations where MSRC lists them. All of those products are listed as fixed by the November 2026 updates. Windows 11 version 26H1 is included, and its update is KB5132059 (build 10.0.28000.3501). MSRC lists Windows 10 version 1607, Windows 10 version 22H2 and Windows Server 2016 under the ESU product family. We list only those Windows 10 channels; this is not a claim that every Windows 10 SKU after 1607 is included.

Microsoft's advice is Customer Action Required: install the Security Update. MSRC lists no workarounds. Microsoft says the Windows updates are cumulative. Use the November 2026 Windows cumulative update for your version. The KB numbers and fixed builds below come from MSRC affected-product data for these two CVEs, which share the same mapping. For Windows 11 versions 24H2, 25H2 and 26H2 (client), MSRC lists KB5132061 (for example 10.0.26100.9974 on 24H2) and Hotpatch KB5132043 (.9911). For Windows Server 2025, MSRC lists KB5131080 (10.0.26100.33822) and Hotpatch KB5131077 (10.0.26100.33730). Windows 11 24H2 and Windows Server 2025 share the 26100 build line but have different fixed builds, so a 26100 row must say whether it is a client or a server. Confirm the article on the MSRC vulnerability page or the Microsoft support article for that KB before you deploy it.

Patching domain controllers and other LDAP-exposed servers first is our advice, not Microsoft's. Microsoft's FAQ for CVE-2026-119958 says successful exploitation would run code in the context of the LDAP service, after a crafted set of LDAP calls, which is why we start there. Microsoft's own published advice is Customer Action Required: install the Security Update, with no workarounds listed. Windows 10 and Windows 11 clients are also on the MSRC affected list, so they still need the November 2026 update. This priority order is not a statement that only domain controllers are affected.

CVE-2026-119952 is a Windows Schannel remote code execution vulnerability, also published in the November 2026 Security Updates. Microsoft is the CNA and rates it Microsoft Critical, CVSS 8.1, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The cve.org record labels that 8.1 as HIGH; we follow Microsoft's Critical rating and do not use a higher score. Microsoft describes an observable timing discrepancy that allows an unauthorized attacker to execute code over a network. Microsoft's FAQ says an unauthenticated attacker could send a specially crafted packet to an affected service, that no authentication or user interaction is required, and that the high attack complexity (AC:H) means an attacker would need specific conditions (for example particular protocol settings or configurations) before an attack could succeed. Microsoft rates exploitation of the latest software release as More Likely only, and marks it as not exploited. It was not in CISA KEV when we rechecked at 19:15 GMT on 10 November 2026. We do not call it exploited, and we do not add victim types beyond what Microsoft published.

CVE-2026-124194 is a Microsoft Outlook spoofing vulnerability. Microsoft is the CNA and rates it Moderate, not Critical, with a CVSS 3.1 base score of 6.5 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. Microsoft marks it as exploited (Exploitation Detected) and not publicly disclosed before 10 November 2026. Microsoft's FAQ says an unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Outlook; opening it could cause Outlook to connect to an attacker-controlled network location without the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Microsoft also says this discloses the user's NTLMv2 hash, that exploitation requires network connectivity and user interaction, and that the Preview Pane is not an attack vector. CISA added CVE-2026-124194 to KEV on 10 November 2026 (catalogue 2026.11.10, released at 19:03 UTC), with a due date of 24 November 2026. The KEV forensicTriage flag for this CVE is No, so we do not say CISA requires forensic triage. CISA's required action is to apply mitigations in accordance with the vendor's instructions, in line with BOD 26-04. That due date binds US federal agencies only; our advice is to apply Microsoft's Office security update now, regardless. Affected products on MSRC are Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2021 and 2024. Office 2019 is not in the affected list. Fixes: Office LTSC 2021 16.0.14334.21048, Office LTSC 2024 16.0.17932.21140, and the Microsoft 365 Apps November 2026 channel builds on Microsoft's security update release notes (Current Channel 2610, 20527.20196; Monthly Enterprise Channel 2610, 20527.20194, 2609, 20430.20264 and 2608, 20326.20320; Semi-Annual Enterprise Channel 2610, 20527.20192, 2609, 20430.20262 and 2608, 20326.20318). This mention is not a standalone Outlook page.

No. Microsoft and CISA have published no indicators of compromise for CVE-2026-119958, CVE-2026-119952 or CVE-2026-124194, and the detection pack contains none. The hunts in the Reactive section and Q5 to Q9b in the pack are CybaVerse advice, our own patterns. None of the KQL has been run against a live tenant.

MSPs and IT teams that run Windows Server, Active Directory domain controllers or other Windows LDAP services, and estates that still have the Windows versions listed above (Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2; Windows Server 2016, 2019, 2022 and 2025). Windows 10 and Windows 11 clients on those versions also need the November 2026 update. The Outlook mention is relevant where you run Microsoft 365 Apps for Enterprise or Office LTSC 2021 or 2024. Office 2019 is not in the affected list for CVE-2026-124194.