> Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for November 2026, which includes 1095 vulnerabilities affecting a range of products, including 64 that Microsoft marked as "critical."Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wildCVE-2026-124194 affects Microsoft Office Outlook. CVE-2026-124194 is a spoofing vulnerability involving Product UI does not Warn User of Unsafe Actions and has a CVSS base score of 6.5.Out of 64 "critical" vulnerabilities, 48 are remote code execution (RCE) vulnerabilities.Microsoft considers exploitation of the following vulnerabilities more likely:CVE-2026-113862 affects Windows Network Address Translation (NAT). CVE-2026-113862 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.1.CVE-2026-118146 and CVE-2026-118148 affect Active Directory Domain Services. CVE-2026-118146 is a remote code execution vulnerability involving Incorrect Authorization and has a CVSS base score of 8.8. CVE-2026-118148 is an elevation of privilege vulnerability involving Incorrect Authorization and has a CVSS base score of 7.5.CVE-2026-118207 affects Microsoft Exchange Server. CVE-2026-118207 is a remote code execution vulnerability involving Use of Incorrectly-Resolved Name or Reference and has a CVSS base score of 8.8.CVE-2026-119952 affects Windows Schannel. CVE-2026-119952 is a remote code execution vulnerability involving Observable Timing Discrepancy and has a CVSS base score of 8.1.Microsoft considers exploitation of the following vulnerabilities less likely:CVE-2026-109459 and CVE-2026-119967 affect Windows Message Queuing Queue Manager. CVE-2026-109459 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.1. CVE-2026-119967 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.1.CVE-2026-110043, CVE-2026-110068 and CVE-2026-111309 affect Microsoft Office Outlook. CVE-2026-110043 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-110068 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-111309 is a remote code execution vulnerability involving Release of Invalid Pointer or Reference and has a CVSS base score of 8.8.CVE-2026-110047, CVE-2026-110067, CVE-2026-111285 and CVE-2026-124185 affect Microsoft Office Word. CVE-2026-110047 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-110067 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-111285 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-124185 is a remote code execution vulnerability involving Use of Uninitialized Resource and has a CVSS base score of 7.5.CVE-2026-111289 and CVE-2026-120003 affect Microsoft Office. CVE-2026-111289 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-120003 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.CVE-2026-112967 affects Windows Xbox Live Networking Service. CVE-2026-112967 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 9.8.CVE-2026-113752 affects Windows Print Spooler Components. CVE-2026-113752 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5.CVE-2026-113753, CVE-2026-113856, CVE-2026-113860, CVE-2026-113861, CVE-2026-113865, CVE-2026-119947, CVE-2026-119960 and CVE-2026-113864 affect Windows Hyper-V. CVE-2026-113753 is an elevation of privilege vulnerability involving Untrusted Pointer Dereference and has a CVSS base score of 8.2. CVE-2026-113856 is an elevation of privilege vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 7.8. CVE-2026-113860 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 7.0. CVE-2026-113861 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 7.5. CVE-2026-113865 is an elevation of privilege vulnerability involving Time-of-check Time-of-use (TOCTOU) Race Condition and has a CVSS base score of 7.8. CVE-2026-119947 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 7.5. CVE-2026-119960 is an elevation of privilege vulnerability involving Use of Uninitialized Resource and has a CVSS base score of 7.5. CVE-2026-113864 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 6.4.CVE-2026-113825 affects Windows SMB Server Network Transport Driver (srvnet.sys). CVE-2026-113825 is a remote code execution vulnerability involving Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and has a CVSS base score of 7.5.CVE-2026-113859 affects Windows TCP/IP. CVE-2026-113859 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5.CVE-2026-114160 affects Azure Managed Grafana. CVE-2026-114160 is an elevation of privilege vulnerability involving Server-Side Request Forgery (SSRF) and has a CVSS base score of 9.8.CVE-2026-114169 affects Windows Raw Image Extension. CVE-2026-114169 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.CVE-2026-116710, CVE-2026-119963 and CVE-2026-119964 affect Windows Message Queuing. CVE-2026-116710 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.1. CVE-2026-119963 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.1. CVE-2026-119964 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.1.CVE-2026-116928 affects Microsoft Windows Search Component. CVE-2026-116928 is a remote code execution vulnerability involving Out-of-bounds Write and has a CVSS base score of 9.8.CVE-2026-118145 affects Windows Function Discovery SSDP Provider. CVE-2026-118145 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5.CVE-2026-118292, CVE-2026-118296, CVE-2026-118297, CVE-2026-118701, CVE-2026-118702, CVE-2026-118711, CVE-2026-118713, CVE-2026-118730, CVE-2026-120786, CVE-2026-120788, CVE-2026-120789 and CVE-2026-124170 affect Microsoft Office Excel. CVE-2026-118292 is a remote code execution vulnerability involving Stack-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118296 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.8. CVE-2026-118297 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118701 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118702 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.8. CVE-2026-118711 is a remote code execution vulnerability involving Stack-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118713 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-118730 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-120786 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-120788 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-120789 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-124170 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 7.5.CVE-2026-118737 affects Windows Remote Procedure Call Runtime. CVE-2026-118737 is a remote code execution vulnerability involving Improper Verification of Cryptographic Signature and has a CVSS base score of 8.1.CVE-2026-119382 affects Windows TPM. CVE-2026-119382 is an elevation of privilege vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 7.8.CVE-2026-119951 affects Windows Deployment Services. CVE-2026-119951 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.1.CVE-2026-119957 affects Windows Remote Desktop Services. CVE-2026-119957 is an elevation of privilege vulnerability involving Double Free and has a CVSS base score of 7.8.CVE-2026-119958 affects Windows LDAP - Lightweight Directory Access Protocol. CVE-2026-119958 is a remote code execution vulnerability involving Out-of-bounds Write and has a CVSS base score of 9.8.CVE-2026-119961 affects Windows Internet Information Services. CVE-2026-119961 is a remote code execution vulnerability involving Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free and has a CVSS base score of 8.1.CVE-2026-119962 affects Windows Cred SSProvider Protocol. CVE-2026-119962 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.1.CVE-2026-119966 and CVE-2026-125137 affect Windows Graphics Kernel. CVE-2026-119966 is an elevation of privilege vulnerability involving Integer Overflow or Wraparound and has a CVSS base score of 7.5. CVE-2026-125137 is an elevation of privilege vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 7.8.CVE-2026-119969 affects Graphic Fonts. CVE-2026-119969 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.CVE-2026-120005 affects Microsoft Office PowerPoint. CVE-2026-120005 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.CVE-2026-122194 affects Microsoft Defender. CVE-2026-122194 is a remote code execution vulnerability involving NULL Pointer Dereference and has a CVSS base score of 8.8.CVE-2026-125136 affects Windows Network Connected Devices Auto-Setup Service. CVE-2026-125136 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.CVE-2026-125134 affects Windows Function Discovery Resource Publication. CVE-2026-125134 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5.CVE-2026-113749 affects Microsoft Windows Codecs Library. CVE-2026-113749 is a remote code execution vulnerability involving Heap-based Buffer Overflow and Integer Overflow or Wraparound and has a CVSS base score of 7.5.CVE-2026-109469 affects Entra Device Registration. CVE-2026-109469 is an elevation of privilege vulnerability involving Authorization Bypass Through User-Controlled Key and has a CVSS base score of 10.0.Other critical vulnerabilities:CVE-2026-119990 affects Azure OpenAI. CVE-2026-119990 is an elevation of privilege vulnerability involving Missing Authentication for Critical Function and has a CVSS base score of 9.8.Talos would also like to highlight the following "important" vulnerabilities as Microsoft has determined that their exploitation is "more likely:"CVE-2026-105501: Windows Installer Elevation of Privilege VulnerabilityCVE-2026-105524: Windows Management Instrumentation Elevation of Privilege VulnerabilityCVE-2026-109473: Windows Kernel Elevation of Privilege VulnerabilityCVE-2026-112745: Azure DevOps Server Information Disclosure VulnerabilityCVE-2026-112759: Windows Task Scheduler Elevation of Privilege VulnerabilityCVE-2026-112791: Windows Print Spooler Components Elevation of Privilege VulnerabilityCVE-2026-112798: Windows NetBIOS Elevation of Privilege VulnerabilityCVE-2026-112811: Windows Print Spooler Components Elevation of Privilege VulnerabilityCVE-2026-112970: Windows SMB Client Elevation of Privilege VulnerabilityCVE-2026-113819: Desktop Window Manager Elevation of Privilege VulnerabilityCVE-2026-116714: Windows AppX Deployment Service Elevation of Privilege VulnerabilityCVE-2026-119389: Windows Storage Elevation of Privilege VulnerabilityCVE-2026-119398: Windows Installer Elevation of Privilege VulnerabilityCVE-2026-119818: Windows Text Services Framework Elevation of Privilege VulnerabilityCVE-2026-119886: Windows Telephony Service Elevation of Privilege VulnerabilityCVE-2026-119892: Windows Installer Elevation of Privilege VulnerabilityCVE-2026-119903: Windows Installer Elevation of Privilege VulnerabilityCVE-2026-119992: Windows HTTP.sys Elevation of Privilege VulnerabilityCVE-2026-121662: Visual Studio Code Remote Code Execution VulnerabilityCVE-2026-121663: Visual Studio Code Security Feature Bypass VulnerabilityCVE-2026-122175: Windows Autopilot Elevation of Privilege VulnerabilityCVE-2026-83563: Winlogon Elevation of Privilege VulnerabilityCVE-2026-88230: Windows LUA File Virtualization Filter Driver Elevation of Privilege VulnerabilityCVE-2026-88238: Windows Camera Frame Server Monitor Elevation of Privilege VulnerabilityCVE-2026-88242: Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityCVE-2026-94514: Windows Kernel Elevation of Privilege VulnerabilityCVE-2026-95874: Xbox Gaming Services Elevation of Privilege VulnerabilityCVE-2026-95935: Windows Graphics Kernel Elevation of Privilege VulnerabilityCVE-2026-95963: Data Sharing Service Client Elevation of Privilege VulnerabilityCVE-2026-95983: Windows Graphics Kernel Elevation of Privilege VulnerabilityCVE-2026-95988: Windows Kernel Elevation of Privilege VulnerabilityCVE-2026-95989: vhdmp.sys Elevation of Privilege VulnerabilityCVE-2026-96077: Windows TCP/IP Denial of Service VulnerabilityCVE-2026-96126: Windows Graphics Kernel Elevation of Privilege VulnerabilityCVE-2026-97013: Windows Shell Elevation of Privilege VulnerabilityCVE-2026-119853: Remote Access API Elevation of Privilege VulnerabilityCVE-2026-88235: Servicing Stack Updates Elevation of Privilege VulnerabilityA complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.In response to these vulnerability disclosures, Talos is releasing a new Snort ruleset that detects attempts to exploit some of them. Please note that additional rules may be released at a future date, and current rules are subject to change pending additional information. Cisco Secure Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Ruleset customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.Snort 2 rule coverage: 1:67457, 1:67456, 1:67459, 1:67458, 1:67463, 1:67462, 1:67461, 1:67460, 1:67455, 1:67454, 116:96, 116:97, 1:67445, 1:67444, 1:67451, 1:67450, 1:67447, 1:67446, 1:67449, 1:67448, 1:67469, 1:67468, 1:67465, 1:67464, 1:67471, 1:67470, 1:67475, 1:67474, 1:67473, 1:67472, 1:67484, 1:67483, 1:67254, 1:67255Snort 3 rule coverage: 1:301740, 1:301741, 1:301743, 1:301742, 1:301739, 116:96, 116:97, 1:301734, 1:301737, 1:301735, 1:301736, 1:301746, 1:301744, 1:301747, 1:301749, 1:301748, 1:301751, 1:301685