November looks calm at first glance. Microsoft shipped 1,094 fixes, 63 of them critical, and only one zero-day. That zero-day is rated Moderate, so it is easy to scroll right past it. Please do not.
The rest of the active attacks this month sit on the edge. Email gateways, remote support appliances, firewalls and build servers from other vendors are under attack right now. So does this affect your environment, and where should you start? Start with the zero-day and the edge, then work inward to identity.
This month at a glance
- One Microsoft zero-day, an Outlook flaw rated Moderate that leaks login hashes when a user opens a crafted file.
- Domain controllers and Exchange carry the worst critical flaws, and two of them need no login.
- Five Message Queuing flaws and eight Hyper-V flaws form the two biggest clusters.
- Several Windows flaws work from the local network alone, so laptops on shared networks are exposed.
- Third party products face active attacks, including Cisco Secure Email, BeyondTrust, GitLab, Puppet and Cisco ASA.
Explore the full November Patch Tuesday release
Use Patch Tuesday Watch to review Microsoft and third-party vulnerabilities, filter by Deployment Urgency or application, and explore individual CVE details.
How we rank deployment
Action1 sorts every update into five colors. Each color sets how fast it should go out.
- 🟥 Red: Zero-day vulnerabilities. Immediate deployment.
- 🟪 Purple: Critical vulnerabilities. Same day deployment.
- 🟦 Blue: High severity vulnerabilities involving Remote Code Execution or Elevation of Privilege. Expedited deployment.
- 🟨 Yellow: Other High and Medium severity vulnerabilities. Important deployment.
- 🟩 Green: Low severity vulnerabilities. Deploy based on your environment.
This month has one red Microsoft item, and its Moderate label hides that. Most of the urgent Microsoft work is purple. Treat the third party flaws under active attack like red.
Where to look first
Find your rows. Skip the ones that do not apply to you.
| If you manage | Look at first | Why |
|---|---|---|
| Windows endpoints and Office | Outlook update, then the monthly Windows update | The Outlook zero-day is under attack. Local network flaws hit laptops. |
| Identity: domain controllers, Active Directory | LDAP and AD DS fixes | One LDAP flaw needs no login. Two AD DS flaws turn any user account into domain control. |
| Exchange Server | Both Exchange fixes | One can be triggered by anyone who can send you email. |
| Business servers: Message Queuing, IIS, Deployment Services | Every server with MSMQ turned on | Five MSMQ flaws allow code to run with no login. |
| Hyper-V hosts | All eight Hyper-V fixes | Several let an attacker inside a guest reach the host. |
| Third party and edge systems | Email gateways, remote support, firewalls, GitLab, Puppet | These are being attacked now. |
What stands out this month
The zero-day wears a Moderate label
The only Microsoft zero-day this month is the Outlook spoofing flaw (CVE-2026-124194). It scores 6.5 and is rated Moderate. Attackers are using it anyway.
Here is how it works. A user opens a crafted message file. Outlook quietly connects to a server the attacker controls and skips the usual external content warning. That connection leaks the user's NTLMv2 hash, a scrambled copy of their login secret. The attacker can then sign in as that person.
This is the kind of flaw that slips through. Severity filters skip it. Users trained to watch for warnings never see one. If your Office updates lag behind Windows, close that gap this week.
The edge is where the active attacks are
Beyond Outlook, the attacks happening now target the systems between your network and the internet. Take the Cisco Secure Email flaw (CVE-2026-76519). One crafted email attachment can give an attacker root on the gateway, with no login needed.
The BeyondTrust Remote Support flaw is also under attack, and that appliance already has trusted access to the machines it manages. Add Cisco ASA VPN crashes, a GitLab code flaw and a Puppet Server flaw, all being exploited.
These boxes often sit outside the normal Windows patch cycle. They get patched by a different team, or not at all. If you only follow Microsoft's calendar, you will miss the fixes attackers care about most this week.
Identity and mail are the biggest Microsoft risks
Among the critical fixes, the worst flaws hit the two systems attackers want most. The Windows LDAP flaw (CVE-2026-119958) scores 9.8 and lets an attacker run code inside LDAP with no login. On a domain controller, that puts the whole domain at risk.
The Exchange flaw (CVE-2026-116928) also scores 9.8. Anyone who can send email to your company can trigger it. A second Exchange flaw needs only a basic mailbox account, the kind phishing steals every day.
Notice the theme. Stolen logins from the Outlook zero-day feed straight into flaws that only need a basic account. Patch identity and mail early, and those stolen hashes buy an attacker much less.
Deployment and verification checklist
- Push the Office update to every Outlook user today, starting with admins and finance staff.
- Patch actively exploited edge devices today: email gateways, remote support appliances, ASA and FTD firewalls, GitLab and Puppet Server.
- Patch domain controllers and Exchange servers next, and restart them. Confirm the November build is installed on each one.
- Find servers running Message Queuing. Turn it off where unused, patch the rest, and block TCP port 1801 from untrusted networks.
- Schedule Hyper-V hosts in their own window, and push Windows updates to laptops that travel first.
- Block outbound SMB (TCP 445) to the internet and watch for odd sign-ins that may use stolen hashes.
- After deployment, check compliance reports for missed machines and pending restarts.
The bottom line
One quiet zero-day and a noisy edge make this a busier month than the numbers suggest. Fix Outlook and the edge first, then lock down identity and mail, then sweep the rest. For the full technical detail on each flaw, see the Action1 CVE Library.
