What’s New Wednesday: November 2026 November 11, 2026 – Posted in: Cyber Security, IT Support, What's New Wednesdays – Tags: Cyber Security, Microsoft, Patch Tuesday, patching, WhatsNewWednesday

Welcome to Patch Tuesday November 2026, this month Microsoft has released patches for 1,235 flaws including 1 zero-day vulnerability, another record breaking number of patches. Running updates on all your software including browsers and Adobe Suite is becoming even more important so please make sure you run updates and restart your PC today. We may restart some of your servers overnight this week if a patch requires it.

Don’t forget to keep an eye out for requests to update your PC in between – Microsoft usually only release patches outside of the regular cycle if they are critically important and many other software providers are now releasing patches two or three times a month. Keep an eye on your browsers too – if it says it needs to restart Chrome/ Edge/ Firefox/ Safari for updates in the top right corner, restart your browser. It’s not just your computer and your laptop, check the about section on your phone and tablet regularly and run updates when they are available.

NEW THIS WEDNESDAY

Overall Microsoft patched:

• 539 Elevation of Privilege Vulnerabilities
• 27 Security Feature Bypass vulnerabilities
• 296 Remote Code Execution Vulnerabilities
• 157 Information Disclosure Vulnerabilities
• 46 Denial of Service Vulnerabilities
• 22 Spoofing Vulnerabilities
• 142 Microsoft Edge Chromium-based Vulnerabilities

There was 1 zero-day vulnerability patched:

CVE-2026-124194 – Microsoft Outlook Spoofing Vulnerability

An unauthenticated attacker could send a message file, if they convince a user to open it in an affected version of Microsoft Outlook, then Outlook would to an attacker-controlled network without showing the expected external-content warning, potentially disclosing authentication information that could be used to impersonate the user.

Releases from other software providers include:

• Barracuda Networks – updates for two vulnerabilities that could let attackers run commands with root privileges.
• Cisco – updates for numerous products, including critical vulnerabilities Catalyst SD-WAN Controller, Secure Email Gateway, and Meraki.
• Google – updates to patch a new Chrome vulnerability exploited in zero-day attacks.
• Ivanti – updates to patch two Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1.
• N-able – working on a hotfix for an alleged 30+ zero-days that were publicly disclosed yesterday, causing the company to take its hosted N-central environments offline.
• Linux – patched a critical RCE vulnerability in the ArubaOS-CX network operating system.
• SAP – updates, which include fixes for four maximum-severity vulnerabilities.
• SonicWall – updates for seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks.
• Vates – updates for a critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks.
• Zyxel – patched a zero-day vulnerability in its GS1900 series network switches that was exploited to compromise nearly 1,000 devices worldwide.

LIST OF CRITICAL PATCHES

GLOSSARY

• Authentication – proving who you are so you can be given access to what you need/have rights to.
• MFA – multi-factor authentication, proving who you are in multiple ways, something you know (like a password or pin), something you are (a fingerprint or retina scan), something you have (like your phone – proved with a code).
• Vulnerability – a defect in software that could allow an attacker to gain control of a system or service.
• Patch – a change to a piece of software, released after sale, to fix a problem or add a feature.
• Zero Day – Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.
• Actively Exploited – an actively exploited vulnerability is one that is being used by malicious actors.
• DDOS / DOS – (Distributed) Denial of Service attack, a method of swamping a service or server with so many false queries at once that it is forced offline.
• Disclosed – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• CVE ID – CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws, the ID is the number assigned to that vulnerability.
• Severity – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• Security Feature Bypass Vulnerabilities – allow for intruders to bypass security features such as password protection or MFA.
• Remote Code Execution Vulnerabilities – allow people to remotely trigger potentially malicious code on your device.
• Information Disclosure Vulnerabilities – allow the wrong people access to your data.
• Denial of Service Vulnerabilities – allow a DOS/DDOS attack to succeed.
• Spoofing Vulnerabilities – allow someone to pretend to be you/your systems.

If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100 or email us at . To stay up to date with our regular What’s New Wednesday emails and receive industry news straight to your inbox, subscribe to our newsletters in the top right.