Microsoft Monthly Security Update (November 2026)

What is affected, what to do

Microsoft has released monthly security update for their products: Vulnerable Product Risk Level Impacts Notes Windows Medium Risk Remote Code Execution Elevation of Privilege Data Manipulation Information Disclosure Denial of Service Security Restriction Bypass Spoofing Extended Security Updates (ESU) Medium Risk Elevation of Privilege Data Manipulation Remote Code Execution Denial of Service Information Disclosure Security Restriction Bypass Spoofing Azure Medium Risk Elevation of Privilege Spoofing Information Disclosure Remote Code Execution Security Restriction Bypass Data Manipulation Developer Tools Medium Risk Information Disclosure Security Restriction Bypass Elevation of Privilege Remote Code Execution Denial of Service Apps Medium Risk Elevation of Privilege Other Medium Risk Elevation of Privilege Information Disclosure Denial of Service Security Restriction Bypass Microsoft Office Medium Risk Spoofing Information Disclosure Remote Code Execution Elevation of Privilege Security Restriction Bypass CVE-2026-124194 is being exploited in the wild. An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.

The available sources name no fixed version. Check the vendor guidance and the linked original advisory.

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Handle the vulnerability in regular vulnerability handling under Art. 21(2)(e) NIS2.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Microsoft has released monthly security update for their products: Vulnerable Product Risk Level Impacts Notes Windows Medium Risk Remote Code Execution Elevation of Privilege Data Manipulation Information Disclosure Denial of Service Security Restriction Bypass Spoofing Extended Security Updates (ESU) Medium Risk Elevation of Privilege Data Manipulation Remote Code Execution Denial of Service Information Disclosure Security Restriction Bypass Spoofing Azure Medium Risk Elevation of Privilege Spoofing Information Disclosure Remote Code Execution Security Restriction Bypass Data Manipulation Developer Tools Medium Risk Information Disclosure Security Restriction Bypass Elevation of Privilege Remote Code Execution Denial of Service Apps Medium Risk Elevation of Privilege Other Medium Risk Elevation of Privilege Information Disclosure Denial of Service Security Restriction Bypass Microsoft Office Medium Risk Spoofing Information Disclosure Remote Code Execution Elevation of Privilege Security Restriction Bypass CVE-2026-124194 is being exploited in the wild. An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Exploitation requires network connectivity and user interaction. Hence, the risk level of this vulnerability is rated as Medium Risk. Open Source Software Medium Risk Elevation of Privilege SQL Server Medium Risk Elevation of Privilege Remote Code Execution Information Disclosure Security Restriction Bypass Server Software Medium Risk Remote Code Execution Elevation of Privilege Spoofing Denial of Service Browser Medium Risk Information Disclosure System Center Medium Risk Information Disclosure Remote Code Execution Microsoft Dynamics Medium Risk Information Disclosure Mariner Medium Risk Elevation of Privilege Number of 'Extremely High Risk' product(s): 0 Number of 'High Risk' product(s): 0 Number of 'Medium Risk' product(s): 14 Number of 'Low Risk' product(s): 0 Evaluation of overall 'Risk Level': Medium Risk Impact: Elevation of Privilege Remote Code Execution Information Disclosure Denial of Service Security Restriction Bypass Data Manipulation Spoofing System / Technologies affected: Windows Extended Security Updates (ESU) Azure Developer Tools Apps Other Microsoft Office Open Source Software SQL Server Server Software Browser System Center Microsoft Dynamics Mariner Solutions: Before installation of the software, please visit the vendor web-site for more details. Apply fixes issued by the vendor.

Source: HKCERT (CC BY 3.0 HK) · HKCERT rating: medium