Patch Tuesday November 2026: 1,093 fixes, 1 exploited. What to patch first
This article first appeared on varaxontech.com , where it is kept up to date. The short version Microsoft released fixes for 1,093 of its own CVEs on 10 November 2026 , after a record 1,408 in October . Over the last four Patch Tuesdays that is 3,875 CVEs . Only 6 of those 3,875 (0.15%) are on CISA's Known Exploited Vulnerabilities (KEV) list. None of the 6 was rated Critical by Microsoft.…
On 10 November 2026, Microsoft released fixes for 1,093 of its own CVEs as part of Patch Tuesday. This marked an increase from previous months, with 402 in August, 972 in September, and 1,408 in October. Over the past four Patch Tuesdays, a total of 3,875 CVEs were released by Microsoft. Only 6 of the 3,875 CVEs (0.15%) were on CISA's Known Exploited Vulnerabilities (KEV) list.
None of the 6 were rated Critical by Microsoft. In November, one of those CVEs, CVE-2026-124194, was exploited, making it the only bug rated as Exploited. The Outlook bug, CVE-2026-124194, is rated Moderate by Microsoft but is on the KEV list. Microsoft's EPSS score for the Outlook bug is 1.6%, which is relatively low compared to other CVEs.
However, attackers have already exploited this vulnerability. It is recommended to prioritize patching the Outlook bug, followed by other KEV-listed vulnerabilities, internet-facing systems, high EPSS scores, and severity. Microsoft's patch Tuesday used to be an easily digestible list, but it has become increasingly complex with the growing number of CVEs.
This analysis aims to help prioritize patches based on exploited vulnerabilities, KEV status, and EPSS scores.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
