Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities
Teaser from the source
Microsoft has released its monthly security update for November 2026, which includes 1328 vulnerabilities affecting a range of products, including 60 that Microsoft marked as "critical." Out of 60 "critical" vulnerabilities, 45 are remote code execution (RCE) vulnerabilities.
This is the RSS-feed teaser. Read the full article at the original source.
Read at Cisco TalosLinked advisories
- CVE-2026-95988Microsoft Windows 11 Version: fehlerhafte Autorisierung
- CVE-2026-118737Improper verification of cryptographic signature in Windows Remote Procedure Call Runtime allows an unauthorized attacker to execute code over a network.
- CVE-2026-119398Microsoft Windows: TOCTOU-Race-Condition
- CVE-2026-116714Microsoft Windows: fehlerhafte Autorisierung
- CVE-2026-118297Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-110043Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-124170Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-113859Microsoft Windows: Use-After-Free
- CVE-2026-119969Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-110043Microsoft Office Outlook Remote Code Execution Vulnerability
- CVE-2026-119961Windows Internet Information Services Remote Code Execution Vulnerability
- CVE-2026-119818Microsoft Windows: fehlerhafte Autorisierung
- CVE-2026-88230Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-114160Azure Managed Grafana Elevation of Privilege Vulnerability
- CVE-2026-124185Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-118297Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-95935Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-125136Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-119958Microsoft Windows: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
- CVE-2026-119398Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-113861Microsoft Windows: Use-After-Free
- CVE-2026-112798Microsoft Windows: Use-After-Free
- CVE-2026-119382Heap-based buffer overflow in Windows TPM allows an authorized attacker to elevate privileges locally.
- CVE-2026-122175Microsoft Windows 11 version 26H1: Use-After-Free
- CVE-2026-116928Windows Search Remote Code Execution Vulnerability
- CVE-2026-111309Microsoft 365 Apps for Enterprise: Freigabe eines ungültigen Zeigers
- CVE-2026-125134Microsoft Windows: Use-After-Free
- CVE-2026-119992Microsoft Windows: Double-Free
- CVE-2026-119967Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
- CVE-2026-111289Microsoft: Use-After-Free
- CVE-2026-119892Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-95988Microsoft Windows 11 Version: fehlerhafte Autorisierung
- CVE-2026-113860Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-125134Windows Function Discovery Resource Publication Remote Code Execution Vulnerability
- CVE-2026-112967Windows Xbox Live Networking Service Remote Code Execution Vulnerability
- CVE-2026-118713Microsoft 365 Apps for Enterprise: Use-After-Free
- CVE-2026-113860Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- CVE-2026-118145Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability
- CVE-2026-110047Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-121662Visual Studio Code Remote Code Execution Vulnerability
- CVE-2026-119992Microsoft Windows: Double-Free
- CVE-2026-88242Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- CVE-2026-118296Microsoft 365 Apps for Enterprise: Double-Free
- CVE-2026-118148Improper authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
- CVE-2026-111289Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network.
- CVE-2026-119990Azure OpenAI Elevation of Privilege Vulnerability
- CVE-2026-118730Microsoft 365 Apps for Enterprise: Use-After-Free
- CVE-2026-109459Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
- CVE-2026-95874Heap-based buffer overflow in Xbox allows an authorized attacker to elevate privileges locally.
- CVE-2026-119952Microsoft Windows: beobachtbare Zeitabweichung (Seitenkanal)
- CVE-2026-83563Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-118711Microsoft 365 Apps for Enterprise: Stack-basierter Pufferüberlauf
- CVE-2026-113856Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- CVE-2026-113862Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
- CVE-2026-95963Improper link resolution before file access ('link following') in Data Sharing Service Client allows an authorized attacker to elevate privileges locally.
- CVE-2026-109473Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-120788Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-94514Microsoft Windows: Race-Condition
- CVE-2026-113864Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- CVE-2026-112745Microsoft Developer Tools: Mehrere Schwachstellen
- CVE-2026-119947Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- CVE-2026-95983Microsoft Windows: Dereferenzierung nicht vertrauenswürdiger Zeiger
- CVE-2026-94514Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privil…
- CVE-2026-95935Microsoft Windows: Ganzzahlüberlauf
- CVE-2026-119957Double free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
- CVE-2026-112967Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.
- CVE-2026-97013Windows Shell Elevation of Privilege Vulnerability
- CVE-2026-120003Microsoft: Heap-basierter Pufferüberlauf
- CVE-2026-113819Microsoft Windows: Use-After-Free
- CVE-2026-119951Microsoft Windows Server: Use-After-Free
- CVE-2026-113749Microsoft Windows Codecs Library Remote Code Execution Vulnerability
- CVE-2026-121662Microsoft Visual Studio Code: Befehlsinjektion
- CVE-2026-105524Weak authentication in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
- CVE-2026-113752Microsoft Windows: Use-After-Free
- CVE-2026-120788Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-120789Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-110043Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-111289Microsoft: Use-After-Free
- CVE-2026-124170Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-119382Windows TPM Elevation of Privilege Vulnerability
- CVE-2026-112745Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to disclose information over a network.
- CVE-2026-113860Microsoft Windows: Use-After-Free
- CVE-2026-120005Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-119389Windows Storage Elevation of Privilege Vulnerability
- CVE-2026-119892Microsoft Windows: fehlerhafte Autorisierung
- CVE-2026-118296Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-112970Microsoft Windows 11 version 26H1: Use-After-Free
- CVE-2026-113862Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over a network.
- CVE-2026-119963Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
- CVE-2026-88242Microsoft Windows: Use-After-Free
- CVE-2026-112791Microsoft Windows: Use-After-Free
- CVE-2026-119818Windows Text Services Framework Elevation of Privilege Vulnerability
- CVE-2026-119960Use of uninitialized resource in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- CVE-2026-119962Microsoft Windows: Double-Free
- CVE-2026-95963Microsoft Windows: Folgen symbolischer Links (Link Following)
- CVE-2026-120788Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-118713Microsoft 365 Apps for Enterprise: Use-After-Free
- CVE-2026-120788Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-118737Microsoft Windows: unzureichende Prüfung kryptografischer Signaturen
- CVE-2026-95988Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-113749Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
- CVE-2026-96077Microsoft Windows: Null-Pointer-Dereferenzierung
- CVE-2026-119963Microsoft Windows: Double-Free
- CVE-2026-118146Microsoft Windows: fehlerhafte Autorisierung
- CVE-2026-113856Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-112970Microsoft Windows 11 version 26H1: Use-After-Free
- CVE-2026-118296Microsoft 365 Apps for Enterprise: Double-Free
- CVE-2026-119969Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
- CVE-2026-113862Microsoft Windows: Use-After-Free
- CVE-2026-119957Microsoft Windows Server: Double-Free
- CVE-2026-112811Stack-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
- CVE-2026-124194Microsoft Outlook Spoofing Vulnerability
- CVE-2026-118730Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-121662Microsoft Visual Studio Code: Befehlsinjektion
- CVE-2026-88235Unintended proxy or intermediary ('confused deputy') in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
- CVE-2026-97013Microsoft Windows: Type-Confusion
- CVE-2026-125136Windows Network Connected Devices Auto-Setup Service Remote Code Execution Vulnerability
- CVE-2026-105524Microsoft Windows: Rechteausweitung
- CVE-2026-119853Untrusted search path in Windows Remote Access API allows an authorized attacker to elevate privileges locally.
- CVE-2026-118292Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-118148Active Directory Domain Services Elevation of Privilege Vulnerability
- CVE-2026-119382Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-120005Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
- CVE-2026-119818Incorrect authorization in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
- CVE-2026-119962Windows CredSSP Remote Code Execution Vulnerability
- CVE-2026-112759Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-109459Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-122175Windows Autopilot Elevation of Privilege Vulnerability
- CVE-2026-124185Microsoft 365 Apps for Enterprise: Verwendung nicht initialisierter Ressourcen
- CVE-2026-125136Heap-based buffer overflow in Windows Network Connected Devices Auto-Setup Service allows an unauthorized attacker to execute code over an adjacent network.
- CVE-2026-114169Windows Raw Image Extension Remote Code Execution Vulnerability
- CVE-2026-112745Microsoft Azure DevOps: Server-Side-Request-Forgery (SSRF)
- CVE-2026-119957Microsoft Windows Server: Double-Free
- CVE-2026-88242Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-112970Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.
- CVE-2026-96077Windows TCP/IP Denial of Service Vulnerability
- CVE-2026-119389Microsoft Windows: Use-After-Free
- CVE-2026-118701Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-116710Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-118713Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-88235Servicing Stack Updates Elevation of Privilege Vulnerability
- CVE-2026-112811Windows Print Spooler Components Elevation of Privilege Vulnerability
- CVE-2026-113860Microsoft Windows: Use-After-Free
- CVE-2026-119990Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-113859Microsoft Windows: Use-After-Free
- CVE-2026-96126Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-118148Microsoft Windows: fehlerhafte Autorisierung
- CVE-2026-118711Microsoft 365 Apps for Enterprise: Stack-basierter Pufferüberlauf
- CVE-2026-112811Microsoft Windows: Stack-basierter Pufferüberlauf
- CVE-2026-119964Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
- CVE-2026-113749Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-113859Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network.
- CVE-2026-125137Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-95989vhdmp.sys Elevation of Privilege Vulnerability
- CVE-2026-119952Windows Schannel Remote Code Execution Vulnerability
- CVE-2026-111285Microsoft: Heap-basierter Pufferüberlauf
- CVE-2026-110043Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
- CVE-2026-112967Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-83563Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-97013Microsoft Windows: Type-Confusion
- CVE-2026-113856Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-113753Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- CVE-2026-119853Microsoft Windows: nicht vertrauenswürdiger Suchpfad
- CVE-2026-110068Microsoft: Use-After-Free
- CVE-2026-124170Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-112791Microsoft Windows: Use-After-Free
- CVE-2026-119969Graphic Fonts Remote Code Execution Vulnerability
- CVE-2026-118701Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-113825Microsoft Windows: Race-Condition
- CVE-2026-119963Windows Message Queuing Remote Code Execution Vulnerability
- CVE-2026-110068Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
- CVE-2026-114169Microsoft Raw Image Extension: Heap-basierter Pufferüberlauf
- CVE-2026-118702Microsoft: Double-Free
- CVE-2026-124194Microsoft 365 Apps for Enterprise: Spoofing
- CVE-2026-105501Microsoft Windows: fehlerhafte Autorisierung
- CVE-2026-119389Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
- CVE-2026-113752Use after free in Windows Print Spooler Components allows an unauthorized attacker to execute code over an adjacent network.
- CVE-2026-118297Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-119947Microsoft Windows: Use-After-Free
- CVE-2026-121663Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-119958Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
- CVE-2026-96126Windows Graphics Kernel Elevation of Privilege Vulnerability
- CVE-2026-118730Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-95874Xbox Gaming Services Elevation of Privilege Vulnerability
- CVE-2026-110068Microsoft Office Outlook Remote Code Execution Vulnerability
- CVE-2026-118737Remote Procedure Call Runtime Remote Code Execution Vulnerability
- CVE-2026-83563Winlogon Elevation of Privilege Vulnerability
- CVE-2026-116928Microsoft Windows: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
- CVE-2026-119961Microsoft Windows: Use-After-Free
- CVE-2026-113753Microsoft Windows 11 version 26H1: Dereferenzierung nicht vertrauenswürdiger Zeiger
- CVE-2026-111285Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-88230Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability
- CVE-2026-118207Microsoft Exchange Server Subscription Edition RTM: falsch aufgelöster Name oder Verweis
- CVE-2026-110068Microsoft: Use-After-Free
- CVE-2026-114160Microsoft Azure Managed Grafana: Server-Side-Request-Forgery (SSRF)
- CVE-2026-116928Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
- CVE-2026-116714Windows AppX Deployment Service Elevation of Privilege Vulnerability
- CVE-2026-119951Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
- CVE-2026-119964Microsoft Windows: Double-Free
- CVE-2026-88238Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability
- CVE-2026-119892Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-119958Microsoft Windows: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
- CVE-2026-119957Windows Remote Desktop Services Elevation of Privilege Vulnerability
- CVE-2026-119966Microsoft Windows: Ganzzahlüberlauf
- CVE-2026-109459Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
- CVE-2026-119886Missing authentication for critical function in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-95963Microsoft Windows: Folgen symbolischer Links (Link Following)
- CVE-2026-119952Microsoft Windows: beobachtbare Zeitabweichung (Seitenkanal)
- CVE-2026-121663Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-119853Remote Access API Elevation of Privilege Vulnerability
- CVE-2026-116710Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
- CVE-2026-96077Microsoft Windows: Null-Pointer-Dereferenzierung
- CVE-2026-114160Microsoft Azure Managed Grafana: Server-Side-Request-Forgery (SSRF)
- CVE-2026-124185Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-119886Microsoft Windows: fehlende Authentifizierung für kritische Funktion
- CVE-2026-120786Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-109469Microsoft Entra Device Registration elevation of privilege CVE-2026-109469 (CVSS 10.0) — already mitigated in the cloud service
- CVE-2026-119382Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-113825Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability
- CVE-2026-113825Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server Network Transport Driver (srvnet.sys) allow…
- CVE-2026-119992Double free in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
- CVE-2026-119398Microsoft Windows: TOCTOU-Race-Condition
- CVE-2026-109469Entra Device Registration Elevation of Privilege Vulnerability
- CVE-2026-118207Microsoft Exchange Server Remote Code Execution Vulnerability
- CVE-2026-113864Microsoft Windows: Use-After-Free
- CVE-2026-112759Heap-based buffer overflow in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.
- CVE-2026-121662Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code loc…
- CVE-2026-113752Microsoft Windows: Use-After-Free
- CVE-2026-113749Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-118145Use after free in Windows Function Discovery SSDP Provider allows an unauthorized attacker to execute code over an adjacent network.
- CVE-2026-114160Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-116710Windows Message Queuing Remote Code Execution Vulnerability
- CVE-2026-113861Microsoft Windows: Use-After-Free
- CVE-2026-118146Incorrect authorization in Active Directory Domain Services allows an authorized attacker to execute code over a network.
- CVE-2026-97013Access of resource using incompatible type ('type confusion') in Windows Shell allows an authorized attacker to elevate privileges locally.
- CVE-2026-119818Microsoft Windows: fehlerhafte Autorisierung
- CVE-2026-119886Windows Telephony Service Elevation of Privilege Vulnerability
- CVE-2026-109469Microsoft Entra: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
- CVE-2026-112791Time-of-check time-of-use (toctou) race condition in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
- CVE-2026-119962Microsoft Windows: Double-Free
- CVE-2026-94514Microsoft Windows: Race-Condition
- CVE-2026-120003Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-119903Microsoft Windows: Pfadüberschreitung (Path Traversal)
- CVE-2026-118145Microsoft Windows: Use-After-Free
- CVE-2026-125134Microsoft Windows: Use-After-Free
- CVE-2026-121663Microsoft Visual Studio Code: unvollständige Sperrliste für Eingaben
- CVE-2026-112811Microsoft Windows: Stack-basierter Pufferüberlauf
- CVE-2026-118701Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-105501Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-113856Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-124194Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-83563Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.
- CVE-2026-118702Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-125137Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-119947Microsoft Windows: Use-After-Free
- CVE-2026-88238Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.
- CVE-2026-113825Microsoft Windows: Race-Condition
- CVE-2026-119398Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-95989Microsoft Windows: Use-After-Free
- CVE-2026-88238Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-111309Microsoft Office Outlook Remote Code Execution Vulnerability
- CVE-2026-119389Microsoft Windows: Use-After-Free
- CVE-2026-116714Microsoft Windows: fehlerhafte Autorisierung
- CVE-2026-109469Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-118292Microsoft 365 Apps for Enterprise: Stack-basierter Pufferüberlauf
- CVE-2026-113865Microsoft Windows: TOCTOU-Race-Condition
- CVE-2026-120789Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-113859Windows TCP/IP Remote Code Execution Vulnerability
- CVE-2026-125134Use after free in Windows Function Discovery Resource Publication allows an unauthorized attacker to execute code over an adjacent network.
- CVE-2026-112798Microsoft Windows: Use-After-Free
- CVE-2026-118730Microsoft 365 Apps for Enterprise: Use-After-Free
- CVE-2026-95983Microsoft Windows: Dereferenzierung nicht vertrauenswürdiger Zeiger
- CVE-2026-124170Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-119966Windows Graphics Kernel Elevation of Privilege Vulnerability
- CVE-2026-120789Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-109473Microsoft Windows: Use-After-Free
- CVE-2026-109473Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-110067Microsoft: Use-After-Free
- CVE-2026-112791Windows Print Spooler Components Elevation of Privilege Vulnerability
- CVE-2026-119960Microsoft Windows: Verwendung nicht initialisierter Ressourcen
- CVE-2026-118701Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-122175Microsoft Windows 11 version 26H1: Use-After-Free
- CVE-2026-95874Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-88238Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-110047Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-110047Microsoft: Use-After-Free
- CVE-2026-119961Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Internet Information Services allows an unauthorized a…
- CVE-2026-114169Microsoft Raw Image Extension: Heap-basierter Pufferüberlauf
- CVE-2026-118296Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-118207Microsoft Exchange Server Subscription Edition RTM: Mehrere Schwachstellen
- CVE-2026-112798Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally.
- CVE-2026-120005Microsoft PowerPoint Remote Code Execution Vulnerability
- CVE-2026-114169Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
- CVE-2026-119969Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-113752Windows Print Spooler Components Remote Code Execution Vulnerability
- CVE-2026-110067Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-113864Microsoft Windows: Use-After-Free
- CVE-2026-109459November 2026 Monthly Patch
- CVE-2026-124194Microsoft Office — Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
- CVE-2026-113861Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-110067Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-112970Windows SMB Client Elevation of Privilege Vulnerability
- CVE-2026-124194Microsoft Releases November 2026 Security Updates
- CVE-2026-111309Release of invalid pointer or reference in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
- CVE-2026-119903Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-119951Windows Deployment Services Remote Code Execution Vulnerability
- CVE-2026-95935Microsoft Windows: Ganzzahlüberlauf
- CVE-2026-113862Microsoft Windows: Use-After-Free
- CVE-2026-120786Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-113819Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- CVE-2026-120005Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-105524Microsoft Windows: Rechteausweitung
- CVE-2026-118207Microsoft Exchange Server Subscription Edition RTM: falsch aufgelöster Name oder Verweis
- CVE-2026-88230Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-109459Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-116714Incorrect authorization in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-96126Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-119967Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
- CVE-2026-119960Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-118292Microsoft 365 Apps for Enterprise: Stack-basierter Pufferüberlauf
- CVE-2026-118702Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-118148Microsoft Windows: fehlerhafte Autorisierung
- CVE-2026-119963Microsoft Windows: Double-Free
- CVE-2026-119964Windows Message Queuing Remote Code Execution Vulnerability
- CVE-2026-95935Windows Graphics Kernel Elevation of Privilege Vulnerability
- CVE-2026-120786Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-109469Microsoft Entra: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
- CVE-2026-119892Microsoft Windows: fehlerhafte Autorisierung
- CVE-2026-116928Microsoft Windows: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
- CVE-2026-120789Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-113753Microsoft Windows 11 version 26H1: Dereferenzierung nicht vertrauenswürdiger Zeiger
- CVE-2026-119990Microsoft Azure Open AI: fehlende Authentifizierung für kritische Funktion
- CVE-2026-113819Desktop Window Manager Elevation of Privilege Vulnerability
- CVE-2026-120786Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-118737Microsoft Windows: unzureichende Prüfung kryptografischer Signaturen
- CVE-2026-105501Microsoft Windows: fehlerhafte Autorisierung
- CVE-2026-111309Microsoft 365 Apps for Enterprise: Freigabe eines ungültigen Zeigers
- CVE-2026-112759Windows Task Scheduler Elevation of Privilege Vulnerability
- CVE-2026-113865Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-95983Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-96126Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-112745Azure DevOps Server Information Disclosure Vulnerability
- CVE-2026-118713Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-120003Microsoft: Heap-basierter Pufferüberlauf
- CVE-2026-105524Windows Management Instrumentation Elevation of Privilege Vulnerability
- CVE-2026-119990Microsoft Azure Open AI: fehlende Authentifizierung für kritische Funktion
- CVE-2026-118207Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
- CVE-2026-88235Microsoft Windows: Confused Deputy
- CVE-2026-119964Microsoft Windows: Double-Free
- CVE-2026-95983Windows Graphics Kernel Elevation of Privilege Vulnerability
- CVE-2026-122194Null pointer dereference in Microsoft Defender allows an unauthorized attacker to execute code over a network.
- CVE-2026-118297Microsoft 365 Apps for Enterprise: Heap-basierter Pufferüberlauf
- CVE-2026-95963Data Sharing Service Client Elevation of Privilege Vulnerability
- CVE-2026-116710Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-96077Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.
- CVE-2026-119961Microsoft Windows: Use-After-Free
- CVE-2026-88242Microsoft Windows: Use-After-Free
- CVE-2026-114160Microsoft Azure: Mehrere Schwachstellen
- CVE-2026-119958Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
- CVE-2026-121663Microsoft Visual Studio Code: unvollständige Sperrliste für Eingaben
- CVE-2026-111285Microsoft: Heap-basierter Pufferüberlauf
- CVE-2026-125136Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-109469Microsoft Entra Device Registration: Schwachstelle ermöglicht Privilegieneskalation
- CVE-2026-113861Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- CVE-2026-119960Microsoft Windows: Verwendung nicht initialisierter Ressourcen
- CVE-2026-118702Microsoft: Double-Free
- CVE-2026-95989Use after free in vhdmp.sys allows an authorized attacker to elevate privileges locally.
- CVE-2026-111289Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-112798Windows NetBIOS Elevation of Privilege Vulnerability
- CVE-2026-113864Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-125137Windows Graphics Kernel Elevation of Privilege Vulnerability
- CVE-2026-122194Microsoft SystemCenter (Malware Protection Engine und Configuration Manager): Mehrere Schwachstellen
- CVE-2026-113865Microsoft Windows: TOCTOU-Race-Condition
- CVE-2026-125137Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-94514Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-105501Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-118711Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-118146Windows Active Directory Domain Services Remote Code Execution Vulnerability
- CVE-2026-110047Microsoft: Use-After-Free
- CVE-2026-119853Microsoft Windows: nicht vertrauenswürdiger Suchpfad
- CVE-2026-119966Microsoft Windows: Ganzzahlüberlauf
- CVE-2026-113819Microsoft Windows: Use-After-Free
- CVE-2026-109473Microsoft Windows: Use-After-Free
- CVE-2026-113865Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- CVE-2026-119992Windows HTTP.sys Elevation of Privilege Vulnerability
- CVE-2026-122194Microsoft Defender Remote Code Execution Vulnerability
- CVE-2026-119947Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-110067Microsoft: Use-After-Free
- CVE-2026-122175Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- CVE-2026-124185Microsoft 365 Apps for Enterprise: Verwendung nicht initialisierter Ressourcen
- CVE-2026-111285Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-88235Microsoft Windows: Confused Deputy
- CVE-2026-95874Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-119966Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-119903Microsoft Windows: Pfadüberschreitung (Path Traversal)
- CVE-2026-119952Observable timing discrepancy in Windows Schannel allows an unauthorized attacker to execute code over a network.
- CVE-2026-113753Windows Hyper-V Elevation of Privilege Vulnerability
- CVE-2026-119967Microsoft Windows: Use-After-Free
- CVE-2026-88230Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.
- CVE-2026-119951Microsoft Windows Server: Use-After-Free
- CVE-2026-118146Microsoft Windows: fehlerhafte Autorisierung
- CVE-2026-110043Microsoft Office: Mehrere Schwachstellen
- CVE-2026-122194Microsoft Malware Protection Engine: Null-Pointer-Dereferenzierung
- CVE-2026-122194Microsoft Malware Protection Engine: Null-Pointer-Dereferenzierung
- CVE-2026-119962Double free in Windows Cred SSProvider Protocol allows an unauthorized attacker to execute code over a network.
- CVE-2026-119886Microsoft Windows: fehlende Authentifizierung für kritische Funktion
- CVE-2026-105501Microsoft Windows: Mehrere Schwachstellen
- CVE-2026-118292Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-95988Incorrect authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-112967Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-95989Microsoft Windows: Use-After-Free
- CVE-2026-118145Microsoft Windows: Use-After-Free
- CVE-2026-112759Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-120003Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
- CVE-2026-118711Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-119967Microsoft Windows: Use-After-Free
- CVE-2026-112745Microsoft Azure DevOps: Server-Side-Request-Forgery (SSRF)
- CVE-2026-119903Windows Installer Elevation of Privilege Vulnerability
Affected vendors and products
- Microsoft Microsoft Entra
- Microsoft Exchange
- Microsoft Microsoft 365 Apps For Enterprise
- Microsoft Microsoft Exchange Server Subscription Edition Rtm
- Microsoft Microsoft Malware Protection Engine
- Microsoft Microsoft Office 365 For Mac
- Microsoft Microsoft Office Ltsc 2021
- Microsoft Microsoft Office Ltsc 2024
- Microsoft Microsoft Office Ltsc For Mac 2021
- Microsoft Microsoft Office Ltsc For Mac 2024
- Microsoft Microsoft Office Online Server
- Microsoft Windows 10 Version 1607
More on Microsoft
Other advisories
- HighCVE-2026-85923Microsoft Developer Tools: Mehrere Schwachstellen
- HighCVE-2026-70336Microsoft Developer Tools: Mehrere Schwachstellen
- CriticalCVE-2026-17888Google Chrome/Microsoft Edge: Mehrere Schwachstellen
- HighCVE-2026-16423Google Chrome und Microsoft Edge: Mehrere Schwachstellen
- HighCVE-2026-14133Google Chrome und Microsoft Edge: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
- CriticalCVE-2026-11663Google Chrome / Microsoft Edge: Mehrere Schwachstellen
- HighCVE-2026-9938Google Chrome und Microsoft Edge: Mehrere Schwachstellen
- HighCVE-2026-8572Google Chrome und Microsoft Edge: Mehrere Schwachstellen
Other news entries
- Microsoft: Recent Windows updates cause SQL Server performance issuesNewsBleepingComputer
- AI found Linux kernel bugs that remained undetected for decadesNewsCSO Online
- Microsoft confirms Windows security updates installation issuesNewsBleepingComputer
- Google Chrome und Microsoft Edge: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Microsoft Developer Tools: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Microsoft: Verwirrung und Phishingverdacht durch Umstellung bei E-RechnungenNewsheise Security
- Microsoft Azure: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Microsoft Power Apps für Dynamics CRM Platform: Schwachstelle ermöglicht Offenlegung von InformationenVulnerabilityBSI CERT-Bund
Source: https://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026/
ID