Microsoft November 2026 Patch Tuesday: 1,093 CVEs Including CVE-2026-124194 — Prioritization, Detection, and Remediation Guide

Microsoft's eleventh Patch Tuesday of 2026 is the largest single-month release we have tracked this year: 1,093 CVEs patched across 287 products and components, with 63 rated Critical, 1,029 Important, and one Moderate. The release includes CVE-2026-124194, called out in the advisory tracking for this cycle. For vulnerability management and SOC teams, the raw volume is the story — but the concentration is what should drive your patching queue.

The top of the CVE-count table reads like an attacker's target list: Microsoft Office Word (65 CVEs), Excel (64), SQL Server (53), the Windows Advanced Rasterization Platform (37), Windows Installer (36), the Windows Graphics Kernel (35), the Windows Kernel (28), SharePoint (27), Windows DNS (22), and a tie at 20 each for Outlook and the Print Spooler components. These are the exact surfaces we see exploited in phishing-driven initial access (Office), privilege escalation after foothold (Installer, Kernel, Spooler), and enterprise data theft (SQL Server, SharePoint). If your organization can only emergency-patch a subset this week, that subset is defined below.

Technical Analysis

Scope and severity distribution

A release of this size spanning 287 products means virtually every Windows endpoint, Office installation, SQL Server instance, and SharePoint farm in your environment carries newly disclosed, patchable exposure as of this month. The absence of any "Low" rated fixes and the 63 Critical ratings indicate this is not a routine maintenance cycle.

The components that matter most to defenders

Microsoft Office Word (65) and Excel (64): Office remains the number-one initial-access vector in the incidents we respond to. The dominant exploitation pattern for Office CVEs is a malicious document delivered via phishing, requiring user interaction to open. Depending on the specific flaw, exploitation leads to remote code execution in the context of the logged-on user — which is why post-exploitation detections (covered below) focus on Office processes spawning unexpected children. The Preview Pane vector in Outlook (20 CVEs this month) is more dangerous because it removes the user-interaction requirement for rendering-based bugs.

SQL Server (53): Fifty-three CVEs in a single month against the enterprise database tier is significant. SQL Server typically sits deep in the network with broad internal reachability, holds crown-jewel data, and is frequently excluded from aggressive patching cadences due to uptime requirements. Expect a mix of remote code execution and elevation-of-privilege flaws reachable by authenticated database users — meaning any compromised service account or low-privilege application credential becomes a lateral-movement springboard. Audit your sysadmin role membership and SQL exposure this week, not this quarter.

Windows Installer (36), Windows Kernel (28), Graphics Kernel (35), Advanced Rasterization Platform (37), Print Spooler (20): These five components are the classic post-compromise privilege-escalation stack. Windows Installer flaws (the legacy of the msiexec / repair-based EoP pattern) reliably produce working privilege-escalation exploits because the component runs as SYSTEM and interacts with user-writable resources. Kernel and graphics-kernel bugs convert any low-privilege foothold — including the Office RCE above — into full SYSTEM. Print Spooler remains a persistent offender years after PrintNightmare; 20 fresh CVEs means your servers with the spooler service enabled are exposed again, and any server that does not actively need to print should have the service disabled as standing policy.

SharePoint (27) and Windows DNS (22): Both are internet- or extranet-adjacent services in many environments. SharePoint has been a favored nation-state and ransomware initial-access target for years; 27 CVEs in one month warrants emergency change windows for any SharePoint instance reachable from outside the corporate LAN. Windows DNS vulnerabilities carry the nightmare scenario of wormable RCE on domain controllers — even when rated Important, DNS CVEs deserve Critical-tier treatment because of the blast radius.

Exploitation status

As of publication, the November 2026 release is a coordinated disclosure event: the value in patching comes from closing the window before reverse-engineered exploit code emerges. Historically, working exploits for Windows Installer and Office CVE classes appear within days to weeks of patch release as researchers diff the binaries. Treat all Critical-rated items — and the EoP bugs in Installer, Kernel, and Spooler regardless of rating — as patch-before-exploitation races. Monitor the CISA Known Exploited Vulnerabilities catalog daily for additions from this release; any KEV listing triggers the associated federal remediation deadlines and should trigger your own emergency SLA.

Detection & Response

Patching is the fix, but your detection posture covers the gap between disclosure and deployment — and catches exploitation of anything you miss. The detections below target the exploitation behavior of the highest-risk component classes patched this month rather than any single CVE signature, which makes them durable across this entire release.

---
title: Office Application Spawning Suspicious Child Process
id: 3f8a2c41-7b19-4e5d-9c62-8a1f0e4b7d55
status: experimental
description: Detects Word, Excel, Outlook, or PowerPoint spawning script interpreters, command shells, or LOLBins — consistent with exploitation of Office document CVEs from the November 2026 Patch Tuesday wave (65 Word, 64 Excel, 20 Outlook CVEs).
references:
  - https://www.tenable.com/blog/microsoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/11/11
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\OUTLOOK.EXE'
      - '\POWERPNT.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Office add-ins invoking scripting engines
level: high
---
title: Windows Installer Repair or Elevated Execution From User-Writable Path
id: 9c1e7a62-3d48-4f1b-b527-6e0d5c9a2f18
status: experimental
description: Detects msiexec.exe executing installer packages from user-writable or temporary locations, a pattern associated with Windows Installer privilege-escalation exploitation (36 Installer CVEs patched November 2026).
references:
  - https://www.tenable.com/blog/microsoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/11/11
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith: '\msiexec.exe'
  selection_paths:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\Downloads\'
      - '\AppData\Roaming\'
      - 'C:\Windows\Temp\'
  filter_standard_switches:
    CommandLine|contains:
      - '/i "C:\Program Files'
      - '/qn'
  condition: selection_image and selection_paths and not filter_standard_switches
falsepositives:
  - Users installing legitimate MSI packages downloaded to Downloads or Temp
level: medium
---
title: Print Spooler Service Spawning Unexpected Child Process
id: 5b2d9f37-8e14-4a6c-d391-2f7b8e6c0a44
status: experimental
description: Detects the Print Spooler (spoolsv.exe) launching child processes, consistent with Print Spooler exploitation (20 Spooler CVEs patched November 2026) for code execution or privilege escalation.
references:
  - https://www.tenable.com/blog/microsoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/11/11
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\spoolsv.exe'
  filter_known:
    Image|endswith:
      - '\splwow64.exe'
      - '\PrintIsolationHost.exe'
  condition: selection and not filter_known
falsepositives:
  - Third-party printer drivers with custom port monitors
level: high

The following Sentinel query hunts across the two highest-volume attack chains in this release: Office-document exploitation leading to LOLBin execution, and SYSTEM-level processes (the post-exploitation state of Kernel, Installer, or Spooler EoP) launching shells. Run it over the past 14 days and re-run after your patch deployment to confirm a clean baseline.

// Hunt: Office exploitation chain + post-EoP SYSTEM shell activity
// Covers the dominant patterns from Nov 2026 Patch Tuesday component classes
let OfficeApps = dynamic(["winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "mspub.exe"]);
let Shells = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe"]);
union
(
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName in~ (OfficeApps)
    | where FileName in~ (Shells)
    | extend HuntType = "OfficeChildProcess"
    | project TimeGenerated, HuntType, DeviceName, AccountName,
              InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessAccountName =~ "SYSTEM"
    | where InitiatingProcessFileName in~ (dynamic(["spoolsv.exe", "msiexec.exe", "svchost.exe"]))
    | where FileName in~ (dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "net1.exe", "whoami.exe"]))
    | extend HuntType = "SystemServiceShell"
    | project TimeGenerated, HuntType, DeviceName, AccountName,
              InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256
)
| order by TimeGenerated desc

For endpoint verification during the patch window, this Velociraptor artifact identifies systems still missing November 2026 cumulative updates by checking installed hotfixes, and simultaneously enumerates machines where the Print Spooler service is still running — your highest-priority EoP exposure.

-- November 2026 Patch Tuesday verification hunt
-- 1) Enumerate installed hotfixes per host to confirm Nov 2026 rollup presence
-- 2) Flag hosts with Print Spooler running (EoP exposure until patched)

LET patches = SELECT Name as Hostname,
       HotFixID, Description, InstalledOn
FROM wmi(namespace="root\\cimv2",
         query="SELECT HotFixID, Description, InstalledOn FROM Win32_QuickFixEngineering")
WHERE InstalledOn > "2026-11-01"

LET spooler = SELECT Name as Hostname2, Pid, Exe
FROM pslist()
WHERE Name =~ "spoolsv"

SELECT * FROM patches

Remediation

1. Patch immediately, in this order.

• Tier 1 (48–72 hours): Internet-facing and identity-critical systems — SharePoint, Windows DNS servers/domain controllers, any SQL Server reachable from user subnets, and all endpoints for the Office and Kernel/Graphics Kernel rollups. Apply the full November 2026 cumulative updates; Microsoft patches are cumulative, so the current rollup supersedes prior months.
• Tier 2 (7 days): Windows Installer, Print Spooler, and Advanced Rasterization Platform coverage on all servers and workstations — these land in the same cumulative updates, so the real work is deployment coverage and reboot completion, not separate packages.
• Tier 3 (14 days): Remaining Important-rated fixes across the long tail of the 287 affected products per your standard cycle.

Verify the specific KB numbers for each OS/build against the Microsoft Security Update Guide and the consolidated November 2026 analysis in the Tenable advisory. Track CVE-2026-124194 and any KEV additions from this release for accelerated SLAs under CISA BOD 22-01 guidance if you are a federal agency — and treat KEV deadlines as best practice even if you are not.

2. Verify deployment programmatically. Do not trust the patch dashboard alone — confirm at the endpoint.

# November 2026 Patch Tuesday verification + spooler hardening audit
# Run elevated. Checks for updates installed on/after Patch Tuesday (Nov 10 2026)

$PatchTuesday = Get-Date "2026-11-10"
$recent = Get-HotFix | Where-Object { $_.InstalledOn -ge $PatchTuesday }
if ($recent) {
    Write-Host "[OK] Updates installed since Nov 2026 Patch Tuesday:" -ForegroundColor Green
    $recent | Select-Object HotFixID, Description, InstalledOn | Format-Table
} else {
    Write-Host "[ALERT] NO updates installed since $PatchTuesday - host is EXPOSED" -ForegroundColor Red
}

# Print Spooler exposure check (20 CVEs this month)
$spooler = Get-Service -Name Spooler -ErrorAction SilentlyContinue
if ($spooler.Status -eq 'Running') {
    Write-Host "[WARN] Print Spooler running on $env:COMPUTERNAME - disable if not a print server:" -ForegroundColor Yellow
    # Uncomment on non-print servers:
    # Stop-Service Spooler -Force; Set-Service Spooler -StartupType Disabled
}

# Confirm pending reboots blocking patch completion
$pendingReboot = Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired"
if ($pendingReboot) { Write-Host "[WARN] Reboot required to complete patching" -ForegroundColor Yellow }

# SQL Server build audit - compare against Nov 2026 GDR/CU baselines in the Security Update Guide
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\*\MSSQLServer\CurrentVersion" -ErrorAction SilentlyContinue |
    Select-Object PSChildName, CurrentVersion

3. Reduce the standing attack surface.

• Disable the Print Spooler on every server that does not serve print jobs — especially domain controllers, where it should never run.
• Constrain SQL Server: remove blanket sysadmin grants, disable xp_cmdshell, and verify SQL instances are not reachable from general user VLANs. Fifty-three patched CVEs is your business case.
• Isolate SharePoint behind a reverse proxy/WAF and confirm no on-prem SharePoint is directly internet-exposed without emergency patching capability.
• Enforce Office hardening: block Office child processes via Attack Surface Reduction rules (rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A) — this neuters the most common post-exploitation chain for the 129 Word/Excel CVEs in this release while patching proceeds.

4. Validate with your SOC. Deploy the Sigma rules and KQL hunts above before patch completion, not after. Any hit during the patch window is a priority investigation: it means exploitation of a component for which exploit code may already be circulating.

The organizations that fare best against a 1,093-CVE month are the ones with rehearsed emergency patch runbooks and behavioral detections that don't depend on per-CVE signatures. If either of those is a gap in your program, this release is the stress test that proves it.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub