{
  "id": 20070278,
  "title": "Patch Tuesday November 2026: 1,093 fixes, 1 exploited. What to patch first",
  "url": "https://urgent.news/2026/11/14/patch-tuesday-november-2026-1-093-fixes-1-exploited-what-to-patch",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-14T23:09:23.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/varaxontech/patch-tuesday-november-2026-1093-fixes-1-exploited-what-to-patch-first-16kj"
  },
  "original_language": "en",
  "account": "On 10 November 2026, Microsoft released fixes for 1,093 of its own CVEs as part of Patch Tuesday. This marked an increase from previous months, with 402 in August, 972 in September, and 1,408 in October. Over the past four Patch Tuesdays, a total of 3,875 CVEs were released by Microsoft. Only 6 of the 3,875 CVEs (0.15%) were on CISA's Known Exploited Vulnerabilities (KEV) list. None of the 6 were rated Critical by Microsoft. In November, one of those CVEs, CVE-2026-124194, was exploited, making it the only bug rated as Exploited. The Outlook bug, CVE-2026-124194, is rated Moderate by Microsoft but is on the KEV list. Microsoft's EPSS score for the Outlook bug is 1.6%, which is relatively low compared to other CVEs. However, attackers have already exploited this vulnerability. It is recommended to prioritize patching the Outlook bug, followed by other KEV-listed vulnerabilities, internet-facing systems, high EPSS scores, and severity. Microsoft's patch Tuesday used to be an easily digestible list, but it has become increasingly complex with the growing number of CVEs. This analysis aims to help prioritize patches based on exploited vulnerabilities, KEV status, and EPSS scores.",
  "summary": "This article first appeared on varaxontech.com , where it is kept up to date. The short version Microsoft released fixes for 1,093 of its own CVEs on 10 November 2026 , after a record 1,408 in October . Over the last four Patch Tuesdays that is 3,875 CVEs . Only 6 of those 3,875 (0.15%) are on CISA's Known Exploited Vulnerabilities (KEV) list. None of the 6 was rated Critical by Microsoft.…",
  "key_points": [
    "Microsoft released 1,093 fixes on Patch Tuesday November 2026",
    "Only 6 of 3,875 CVEs were on CISA's Known Exploited Vulnerabilities list",
    "CVE-2026-124194 was exploited, making it the only bug rated Exploited"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}