I checked Microsoft’s November security release, and Windows has 726 vulnerabilities

• Microsoft reports 1,094 CVEs across its products in the November 2026 security release, including 726 Windows vulnerabilities.
• Outlook spoofing vulnerability CVE-2026-124194 is flagged as having exploitation detected.
• Office accounts for 174 vulnerabilities, followed by SQL Server with 59 and Developer Tools with 53.
• Microsoft is also republishing information about 165 non-Microsoft CVEs, excluding Chrome vulnerabilities.

Microsoft has released its November 2026 security updates, addressing 726 vulnerabilities across the Windows product family as part of a release covering 1,094 Microsoft CVEs. The November 10 release also flags an Outlook spoofing vulnerability with exploitation detected.

According to Microsoft’s November 2026 Security Update Guide, Windows accounts for the largest share of vulnerabilities, followed by Office, SQL Server, and Developer Tools.

November’s release is smaller than October’s already record-breaking Patch Tuesday. Last month, the company addressed 1,413 vulnerabilities across its products, including 1,102 Windows vulnerabilities. This month’s release reduces those figures to 1,094 Microsoft CVEs and 726 Windows vulnerabilities.

Microsoft also identifies an Outlook spoofing vulnerability, CVE-2026-124194, under the “Exploitation Detected” category.

November’s Patch Tuesday covers more than 1,000 Microsoft CVEs

Microsoft’s November release covers nine product families, with Windows accounting for the largest share. The complete breakdown looks like this.

Windows accounts for about two-thirds of the vulnerabilities listed in November’s release, reinforcing the importance of keeping supported Windows installations up to date.

Related

KB5132061 (build 26300.9974) for Windows 11 drops as part of the November 2026 update

KB5131096 (build 19045.7846) for Windows 10 ESU drops as the November 2026 update

KB5132059 (Build 28000.3501) for Windows 11 26H1 drops as part of the November 2026 update

KB5127646 (Build 28000.3231) for Windows 11 26H1 drops as part of the October 2026 update

Compared with October, November addresses 319 fewer Microsoft CVEs. Windows 11, Windows 10, and Server products also see a reduction of 376 vulnerabilities, going from 1,102 to 726.

System updates are cumulative, meaning the monthly security release includes security fixes for supported operating system versions, along with other changes.

Microsoft flags an Outlook vulnerability

One of the most important entries in the November release is CVE-2026-124194, an Outlook spoofing vulnerability that the company lists under “Exploitation Detected.”

This designation indicates that Microsoft has detected exploitation activity involving the vulnerability, making it a priority for security teams to review.

The November release does not provide additional details about the scope of attacks or the number of affected devices. However, organizations using Outlook should review the vulnerability information and apply the applicable security updates.

Microsoft republishes details about 165 non-Microsoft CVEs

In addition to the 1,094 Microsoft CVEs, the company is republishing information about 165 non-Microsoft CVEs through its Security Update Guide.

Microsoft excludes Chrome vulnerabilities from this republished information.

These entries are separate from the Microsoft vulnerability count and should not be added to the 1,094 CVEs when comparing November’s release with previous months.

Pureinfotech’s Take

Microsoft’s November release is smaller than October’s, but security updates remain important. The Outlook vulnerability with exploitation detected deserves particular attention, especially for organizations that rely on the application.

For home users, I recommend installing these security updates rather than postponing them unnecessarily. Microsoft’s monthly cumulative updates include security fixes for supported Windows versions, so keeping devices current remains one of the simplest ways to stay protected.

For organizations, I’d prioritize reviewing CVE-2026-124194 and assessing which systems are affected. Security teams should also consider their exposure to the other vulnerabilities when planning this month’s update deployment.