Microsoft's November 2026 Patch Tuesday has landed with what Dark Reading aptly calls an "overflowing cornucopia" of vulnerabilities—an urgent patch wave that includes critical fixes for Exchange Server, SharePoint, Windows Search, and LDAP implementations. Buried in this release is perhaps the most concerning element: an actively exploited Outlook vulnerability that remains unpatched as of this writing, leaving organizations exposed to ongoing attacks while they scramble to prioritize the flood of other critical fixes.

This month's release represents the kind of worst-case scenario vulnerability management teams dread: multiple CVSS 9.0+ bugs affecting enterprise perimeter and authentication infrastructure, compounded by a zero-day with no available fix. For defenders already stretched thin by staffing shortages and alert fatigue, this Patch Tuesday demands ruthless prioritization and immediate executive visibility.

Technical Analysis

The Unpatched Outlook Threat

Microsoft confirmed active exploitation of an Outlook security vulnerability that remains without a patch as of the November release cycle. While specific CVE details are still emerging, attackers are weaponizing this flaw to execute code in the context of the logged-on user, typically requiring some form of social engineering—such as convincing a target to open a malicious email or preview a weaponized attachment.

The exploitation vector leverages Outlook's rich text formatting (RTF) and object linking capabilities, allowing attackers to bypass Protected View in certain configurations. This continues a troubling trend of Office suite vulnerabilities serving as initial access brokers for ransomware and espionage campaigns.

Critical Exchange Server Vulnerabilities

November's Exchange updates address remote code execution flaws that affect on-premises Exchange Server 2016, 2019, and Subscription Edition deployments. These vulnerabilities allow authenticated attackers to execute arbitrary code on Exchange servers—critical infrastructure that typically sits at the heart of organizational identity and communication.

Unlike previous Exchange zero-days (such as the HAFNIUM-era exploits), these bugs require valid credentials, limiting their utility to external attackers but making them extremely dangerous for post-compromise lateral movement. Once an attacker gains a foothold via phishing or credential theft, these Exchange RCEs provide immediate paths to domain dominance.

SharePoint and Windows Search Exposure

SharePoint Server receives fixes for elevation of privilege and remote code execution vulnerabilities affecting SharePoint Server 2019 and Subscription Edition. These flaws could allow attackers to execute code in the context of the SharePoint application pool or farm account—often over-privileged service accounts with extensive database and network access.

Windows Search vulnerabilities affecting both server and workstation operating systems could allow attackers to execute code via malicious search queries or indexing operations. Given Windows Search's deep integration into the OS and its high-privilege execution context (often SYSTEM), successful exploitation provides immediate privilege escalation.

LDAP Implementation Flaws

The LDAP vulnerabilities patched this month affect domain controllers and represent a significant risk to Active Directory environments. These bugs could allow unauthenticated attackers to execute code or cause denial-of-service conditions on domain controllers, potentially crippling enterprise authentication or providing direct paths to domain compromise.

Detection & Response

While we await specific CVE details for the Outlook zero-day, defenders should implement behavioral detection for the exploitation patterns described. The following rules and queries target post-exploitation behaviors common to these vulnerability classes.

SIGMA Detection Rules

YAML

---
title: Outlook Process Spawning Suspicious Child Process
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects Outlook.exe spawning unusual child processes, potentially indicating exploitation of the unpatched Outlook vulnerability
references:
  - https://www.darkreading.com/vulnerabilities-threats/november-patch-tuesday-cornucopia-cves
author: Security Arsenal
date: 2026/11/12
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\OUTLOOK.EXE'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  filter:
    CommandLine|contains:
      - 'OfficeUpdate'
      - 'Microsoft.Office'
  condition: selection and not filter
falsepositives:
  - Legitimate Office add-ins or updates spawning scripts
level: high
---
title: Exchange Server W3WP Process Command Execution
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects command shell execution from Exchange IIS worker processes, indicative of Exchange RCE exploitation
references:
  - https://www.darkreading.com/vulnerabilities-threats/november-patch-tuesday-cornucopia-cves
author: Security Arsenal
date: 2026/11/12
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    ParentCommandLine|contains: 'MSExchange'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\net.exe'
      - '\whoami.exe'
  condition: selection
falsepositives:
  - Exchange administrative scripts (rare in production w3wp context)
level: critical
---
title: SharePoint Process Spawning Command Shell
id: 8b2c4d91-5f6a-4b8c-9d1e-2f3a4b5c6d7e
status: experimental
description: Detects SharePoint OWSTIMER or w3wp processes spawning command shells, potential indicator of SharePoint exploitation
references:
  - https://www.darkreading.com/vulnerabilities-threats/november-patch-tuesday-cornucopia-cves
author: Security Arsenal
date: 2026/11/12
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\OWSTIMER.EXE'
      - '\w3wp.exe'
    ParentCommandLine|contains:
      - 'SharePoint'
      - 'SPUserCode'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\cscript.exe'
  condition: selection
falsepositives:
  - SharePoint administrative maintenance scripts
level: high

Microsoft Sentinel / Defender KQL

Hunt for suspicious child processes spawning from Outlook, Exchange, or SharePoint processes across your environment:

KQL — Microsoft Sentinel / Defender

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("OUTLOOK.EXE", "w3wp.exe", "OWSTIMER.EXE")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "net.exe", "whoami.exe")
| where InitiatingProcessCommandLine contains "MSExchange" or InitiatingProcessFileName =~ "OUTLOOK.EXE" or InitiatingProcessCommandLine contains "SharePoint"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc

Velociraptor VQL

Hunt for suspicious process execution chains involving Office and server processes:

VQL — Velociraptor

-- Hunt for Outlook, Exchange, and SharePoint spawning suspicious children
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (
  Name =~ 'OUTLOOK.EXE' 
  AND (
    CommandLine =~ 'cmd.exe' 
    OR CommandLine =~ 'powershell.exe'
    OR CommandLine =~ 'wscript.exe'
  )
) OR (
  (Name =~ 'w3wp.exe' OR Name =~ 'OWSTIMER.EXE')
  AND (
    CommandLine =~ 'cmd.exe'
    OR CommandLine =~ 'powershell.exe'
    OR CommandLine =~ 'net.exe'
    OR CommandLine =~ 'whoami.exe'
  )
)

Remediation and Verification Script

Use this PowerShell script to verify patch levels on critical systems and identify those requiring immediate attention:

PowerShell

# Check for November 2026 patches on Exchange, SharePoint, and Domain Controllers
$Hotfixes = @("KB5034779", "KB5034780", "KB5034781", "KB5034782", "KB5034783")  # November 2026 cumulative updates

Write-Host "=== Checking Installed Hotfixes ===" -ForegroundColor Cyan

# Check Exchange servers
$ExchangeServers = Get-ExchangeServer | Where-Object {$_.ServerRole -match "Mailbox"}
foreach ($Server in $ExchangeServers) {
    $Installed = Get-HotFix -ComputerName $Server.Name | Where-Object {$_.HotFixID -in $Hotfixes}
    if (-not $Installed) {
        Write-Warning "$($Server.Name) missing November 2026 Exchange updates"
    } else {
        Write-Host "$($Server.Name) patched" -ForegroundColor Green
    }
}

# Check SharePoint servers
$SharePointServers = Get-SPServer | Where-Object {$_.Role -ne "Invalid"}
foreach ($Server in $SharePointServers) {
    $Installed = Get-HotFix -ComputerName $Server.Name | Where-Object {$_.HotFixID -in $Hotfixes}
    if (-not $Installed) {
        Write-Warning "$($Server.Name) missing November 2026 SharePoint updates"
    }
}

# Check Domain Controllers for LDAP patches
$DCs = Get-ADDomainController -Filter *
foreach ($DC in $DCs) {
    $Installed = Get-HotFix -ComputerName $DC.Name | Where-Object {$_.HotFixID -in $Hotfixes}
    if (-not $Installed) {
        Write-Warning "DC $($DC.Name) missing LDAP security updates"
    }
}

# Verify Outlook protection settings (compensating control for unpatched CVE)
$RegistryPath = "HKLM:\SOFTWARE\Microsoft\Office\16.0\Outlook\Security"
if (Test-Path $RegistryPath) {
    $EnableUnsafeClientMailRules = Get-ItemProperty -Path $RegistryPath -Name "EnableUnsafeClientMailRules" -ErrorAction SilentlyContinue
    if ($EnableUnsafeClientMailRules.EnableUnsafeClientMailRules -eq 1) {
        Write-Warning "Outlook unsafe mail rules enabled - consider disabling as compensating control"
    }
}

Write-Host "=== Verification Complete ===" -ForegroundColor Cyan

Remediation

Immediate Actions Required

For the Unpatched Outlook Vulnerability:

Implement registry key HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Options\Mail with DWORD "BlockExtContent"=1 to block external content loading
Disable automatic picture downloads in Outlook Trust Center
Enable Protected View for all files originating from the Internet
Implement network segmentation preventing Outlook clients from making outbound SMB connections (mitigates credential theft vectors)

For Exchange Server:

Apply November 2026 Cumulative Updates immediately to all internet-facing Exchange servers
Verify installation of KB5034779 or later
Run Exchange Health Checker script post-patch to validate installation
Review Exchange server logs for signs of prior compromise (unusual PowerShell remoting, suspicious EWS connections)

For SharePoint:

Install November 2026 updates for SharePoint Server 2019 and Subscription Edition
Verify KB5034780 installation
Review SharePoint ULS logs for unexpected process execution

For Domain Controllers (LDAP):

Prioritize LDAP patches on all domain controllers immediately
Implement LDAP channel binding and signing requirements if not already enforced
Monitor for abnormal LDAP query volumes indicating reconnaissance

Patch Verification: Use the PowerShell script provided above to verify patch levels across your environment. CISA has indicated these vulnerabilities likely meet the criteria for addition to the Known Exploited Vulnerabilities catalog, which would impose federal civilian executive branch remediation deadlines—private organizations should treat these with equivalent urgency.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

November 2026 Patch Tuesday: Critical Exchange, SharePoint, and LDAP Bugs Demand Immediate Triage