Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for November 2026, which includes 1095 vulnerabilities affecting a range of products, including 64 that Microsoft marked as "critical." Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild CVE-2026-124194 affects Microsoft Office Outlook. CVE-2026-124194 is a spoofing vulnerability involving Product UI does not Warn User of Unsafe Actions and has a CVSS base score of 6.5. Out of 64 "critical" vulnerabilities, 48 are remote code execution (RCE) vulnerabilities. Microsoft considers exploitation of the following vulnerabilities more likely: CVE-2026-113862 affects Windows Network Address Translation (NAT). CVE-2026-113862 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.1. CVE-2026-118146 and CVE-2026-118148 affect Active Directory Domain Services. CVE-2026-118146 is a remote code execution vulnerability involving Incorrect Authorization and has a CVSS base score of 8.8. CVE-2026-118148 is an elevation of privilege vulnerability involving Incorrect Authorization and has a CVSS base score of 7.5. CVE-2026-118207 affects Microsoft Exchange Server. CVE-2026-118207 is a remote code execution vulnerability involving Use of Incorrectly-Resolved Name or Reference and has a CVSS base score of 8.8. CVE-2026-119952 affects Windows Schannel. CVE-2026-119952 is a remote code execution vulnerability involving Observable Timing Discrepancy and has a CVSS base score of 8.1. Microsoft considers exploitation of the following vulnerabilities less likely: CVE-2026-109459 and CVE-2026-119967 affect Windows Message Queuing Queue Manager. CVE-2026-109459 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.1. CVE-2026-119967 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.1. CVE-2026-110043 , CVE-2026-110068 and CVE-2026-111309 affect Microsoft Office Outlook. CVE-2026-110043 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-110068 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-111309 is a remote code execution vulnerability involving Release of Invalid Pointer or Reference and has a CVSS base score of 8.8. CVE-2026-110047 , CVE-2026-110067 , CVE-2026-111285 and CVE-2026-124185 affect Microsoft Office Word. CVE-2026-110047 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-110067 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-111285 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-124185 is a remote code execution vulnerability involving Use of Uninitialized Resource and has a CVSS base score of 7.5. CVE-2026-111289 and CVE-2026-120003 affect Microsoft Office. CVE-2026-111289 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-120003 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-112967 affects Windows Xbox Live Networking Service. CVE-2026-112967 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 9.8. CVE-2026-113752 affects Windows Print Spooler Components. CVE-2026-113752 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5. CVE-2026-113753 , CVE-2026-113856 , CVE-2026-113860 , CVE-2026-113861 , CVE-2026-113865 , CVE-2026-119947 , CVE-2026-119960 and CVE-2026-113864 affect Windows Hyper-V. CVE-2026-113753 is an elevation of privilege vulnerability involving Untrusted Pointer Dereference and has a CVSS base score of 8.2. CVE-2026-113856 is an elevation of privilege vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 7.8. CVE-2026-113860 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 7.0. CVE-2026-113861 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 7.5. CVE-2026-113865 is an elevation of privilege vulnerability involving Time-of-check Time-of-use (TOCTOU) Race Condition and has a CVSS base score of 7.8. CVE-2026-119947 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 7.5. CVE-2026-119960 is an elevation of privilege vulnerability involving Use of Uninitialized Resource and has a CVSS base score of 7.5. CVE-2026-113864 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 6.4. CVE-2026-113825 affects Windows SMB Server Network Transport Driver (srvnet.sys). CVE-2026-113825 is a remote code execution vulnerability involving Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and has a CVSS base score of 7.5. CVE-2026-113859 affects Windows TCP/IP. CVE-2026-113859 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5. CVE-2026-114160 affects Azure Managed Grafana. CVE-2026-114160 is an elevation of privilege vulnerability involving Server-Side Request Forgery (SSRF) and has a CVSS base score of 9.8. CVE-2026-114169 affects Windows Raw Image Extension. CVE-2026-114169 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-116710 , CVE-2026-119963 and CVE-2026-119964 affect Windows Message Queuing. CVE-2026-116710 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.1. CVE-2026-119963 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.1. CVE-2026-119964 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.1. CVE-2026-116928 affects Microsoft Windows Search Component. CVE-2026-116928 is a remote code execution vulnerability involving Out-of-bounds Write and has a CVSS base score of 9.8. CVE-2026-118145 affects Windows Function Discovery SSDP Provider. CVE-2026-118145 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5. CVE-2026-118292 , CVE-2026-118296 , CVE-2026-118297 , CVE-2026-118701 , CVE-2026-118702 , CVE-2026-118711 , CVE-2026-118713 , CVE-2026-118730 , CVE-2026-120786 , CVE-2026-120788 , CVE-2026-120789 and CVE-2026-124170 affect Microsoft Office Excel. CVE-2026-118292 is a remote code execution vulnerability involving Stack-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118296 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.8. CVE-2026-118297 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118701 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118702 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.8. CVE-2026-118711 is a remote code execution vulnerability involving Stack-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118713 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-118730 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-120786 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-120788 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-120789 is a remote code execution vulnerability involving Heap-b