November 2026 Patch Tuesday: what to patch first on your servers
Microsoft fixed more than 1,000 CVEs on November 10, 2026. The one exploited zero-day is in Outlook and ships through Office updates, not the Windows update. Two 9.8 bugs need no sign-in. Here is the order, the KB numbers, and the Exchange catch.
Find and fix CVEs across the fleet
Microsoft's November 10, 2026 release fixes more than 1,000 CVEs (Tenable counts 1,093; The Register counts 1,094). Only one is being exploited, and it is the easiest one to miss: it is in Outlook, and its fix comes through Office updates, not the Windows cumulative update your servers install. A server that took this month's Windows update can still have the exploited bug on it.
Here is what matters for Windows servers, in the order we would patch.
1. The exploited zero-day: Outlook (CVE-2026-124194)
#- What it is: a spoofing bug in Outlook. Microsoft rates it 6.5 and Moderate, and marks it Exploitation Detected. A person has to open a crafted file; Outlook then reaches out to the attacker and gives away the user's NTLMv2 password hash, which an attacker can crack or relay.
- Where the fix is: in Office, not Windows. Office LTSC 2021 is fixed in build 16.0.14334.21048 and Office LTSC 2024 in 16.0.17932.21140. Microsoft 365 Apps get it through their own update channel.
- Why servers care: terminal servers, Citrix and Remote Desktop hosts, and admin jump boxes often have Outlook installed and are used by people with high privileges. Those hashes are the ones an attacker wants.
2. Two 9.8 bugs that need no sign-in
#| CVE | What | Score | Sign-in needed | Microsoft's outlook |
|---|---|---|---|---|
| CVE-2026-119958 | Windows LDAP remote code execution | 9.8 Critical | No | Exploitation Less Likely |
| CVE-2026-116928 | Windows Search remote code execution | 9.8 Critical | No | Exploitation Less Likely |
The LDAP bug is the one to rush on domain controllers: no account and no user action needed, over the network. Microsoft's description of the Windows Search bug says the attack path is an email processed by Windows Search for Exchange, so put Exchange servers near the front too. "Less likely" is Microsoft's guess, not a promise, and a 9.8 with no sign-in is what attackers reverse engineer first.
3. Critical bugs Microsoft says are more likely to be exploited
#| CVE | What | Score | Notes |
|---|---|---|---|
| CVE-2026-118146 | Active Directory Domain Services remote code execution | 8.8 | Any signed-in domain user; no user action |
| CVE-2026-118207 | Exchange Server remote code execution | 8.8 | Signed-in attacker; fixed only for Exchange Subscription Edition |
| CVE-2026-119952 | Windows Schannel (TLS) remote code execution | 8.1 | No sign-in; hard to pull off |
| CVE-2026-113862 | Windows NAT remote code execution | 8.1 | No sign-in; a race condition |
All four are rated Critical and Exploitation More Likely. The AD DS bug means any ordinary domain account can attack a domain controller, which is why domain controllers lead this month twice over.
The KB numbers for Windows Server
#| Windows Server | November 2026 cumulative update |
|---|---|
| 2016 | KB5131291 |
| 2019 | KB5131085 |
| 2022 | KB5131090 |
| 2025 | KB5131080 (hotpatch machines: KB5131077) |
These fix the LDAP, Windows Search, AD DS, Schannel and NAT bugs above. The SMB server bug this month (CVE-2026-113825, srvnet.sys, 7.5) affects 2019, 2022 and 2025, and is in the same updates.
The Exchange catch
#Microsoft's fix for CVE-2026-118207 lists only Exchange Server Subscription Edition (build 15.02.2562.057). Exchange 2016 and 2019 left support on October 14, 2025, and the paid Extended Security Update program that kept patching them was scheduled to end with October 2026. November is the first Patch Tuesday since, and its Critical Exchange fix lists only Subscription Edition. If you still run 2016 or 2019, plan on it not getting this fix: move to Subscription Edition, or take the server off the internet until you do.
The order we would patch
#- Domain controllers: KB for their version, this week. LDAP (no sign-in) and AD DS (any domain user).
- Exchange servers: Subscription Edition update plus the Windows update. Find any 2016 or 2019 left behind.
- Remote Desktop, Citrix and jump hosts with Outlook: the Office update as well as the Windows one.
- Everything else: the cumulative update through your normal rings: a pilot group first, then the rest.
How Gardience helps
#- Find what you have: Live questions asks every Windows and Linux machine at once. "Installed software: Outlook" lists every server with Outlook and its version, so you know which ones need the Office fix. "Service: MSExchangeTransport" finds every Exchange server, including the ones nobody remembers.
- Patch in rings: patch the pilot ring, check it, and let the rest follow, with a change window and approval if you want one.
- Prove it: the Vulnerabilities page checks each Windows server's build against Microsoft's update data and shows which machines still have each Windows CVE, and the evidence pack records what was patched, when, and who approved it.
Sources: Microsoft Security Update Guide, CVE-2026-124194, CVE-2026-119958, CVE-2026-116928, CVE-2026-118146, CVE-2026-118207, Tenable, The Register, Microsoft Exchange Team on the ESU program.
Find every exposed machine in your first hour
The free license covers 10 Windows and Linux machines with no end date: CVE matching with CISA KEV and EPSS, and a one-click fix for only the exposed machines, with approval.
Free 10-machine licenseFree 90-day trial (25 machines)How CVE matching works