![Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/video-ATTCK2-1?wid=530&hei=349&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0)
![Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Edward-Gonam-Qatar-Blog2-1?wid=530&hei=349&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0)
?wid=2048&hei=1350&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0)
Microsoft addressed 1,252 vulnerabilities in its November 2026 security update release, including one exploited zero-day vulnerability and 68 Critical vulnerabilities.
This month's leading risk types by exploitation technique are elevation of privilege with 533 patches (43%), remote code execution (RCE) with 296 patches (24%), and information disclosure with 156 patches (12%).
Figure 1. Breakdown of November 2026 Patch Tuesday exploitation techniques
Figure 2. Breakdown of product families affected by November 2026 Patch Tuesday
Preview-pane-triggered exploitation remains a dominant attack surface pattern for the third consecutive month, with eight Critical RCE vulnerabilities across Microsoft Office applications including Outlook and Word. CVE-2026-110043 and CVE-2026-110068 in Outlook exemplify the risk: Merely selecting a malicious message in the Reading Pane or previewing an attachment in File Explorer triggers code execution without any click or macro prompt. This attack pattern continues to be attractive to phishing operators and initial access brokers because it converts document or message delivery into reliable code execution, bypassing the user-action barrier that many enterprises treat as a training backstop.
Identity platform components face elevated risk this month with Critical flaws in both Lightweight Directory Access Protocol (LDAP) and Active Directory Domain Services (AD DS). CVE-2026-119958 enables RCE against LDAP, while CVE-2026-118146 and CVE-2026-118148 target AD DS with RCE and elevation-of-privilege attack paths, respectively. These protocols underpin domain authentication and authorization for every joined workstation and server; successful exploitation of either can cascade to domain-wide compromise. Similar identity fabric vulnerabilities have historically been targeted by advanced adversaries seeking persistent access to enterprise environments.
Windows Hyper-V sees an unusually high concentration of privilege escalation vulnerabilities this month, with eight CVEs spanning multiple flaw classes. CVE-2026-113753, CVE-2026-113856, and CVE-2026-113860 all enable elevation of privilege within the hypervisor boundary. Hyper-V underpins Azure compute infrastructure and endpoint features such as Windows Sandbox, Credential Guard, and other Virtualization-Based Security capabilities, so the exposure extends beyond dedicated virtualization hosts to ordinary Windows endpoints with these features enabled.
Legacy network services including Server Message Block (SMB) and Print Spooler continue to draw Critical-severity RCE findings, reinforcing the persistent risk these widely deployed components carry. The unauthenticated network-reachable RCE cluster spans 14 CVEs this month, with Windows Message Queuing (MSMQ) vulnerabilities such as CVE-2026-109459 and CVE-2026-116710 representing exposure on any system with MSMQ enabled. These services listen on the network by design and often lack authentication requirements for initial protocol negotiation, making any exposed instance an immediate target for opportunistic scanning. This class of legacy network service has historically been targeted in wormable exploitation scenarios.
CVE-2026-124194 is a Moderate spoofing vulnerability in Microsoft Outlook with a CVSS score of 6.5, and Microsoft confirms it is being exploited in the wild. The flaw stems from the product UI failing to warn users of unsafe actions: A specially crafted message file can cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, disclosing the victim's NTLMv2 hash.
Outlook is the default mail client across most enterprise Windows deployments, making any flaw that bypasses user safety prompts a direct initial access vector at scale. Exploitation requires the victim to open a malicious file delivered via email or another channel. The Preview Pane is not an attack vector for this particular CVE. Once the victim opens the file, Outlook silently initiates an outbound connection, and the captured NTLMv2 hash can be relayed or cracked offline to impersonate the user against other services that accept NTLM authentication.
The Moderate severity rating reflects the user interaction requirement, but the real-world exposure is broader than the score suggests. Credential disclosure flaws that require only a file open, bypass visible warnings, and yield reusable authentication material are a well-established technique in targeted intrusion campaigns. Similar spoofing primitives in Outlook have historically drawn attention from both commodity phishing operators and advanced adversaries seeking footholds in enterprise environments.
| Severity | CVSS Score | CVE | Description | Action Required? |
| Moderate | 6.5 | CVE-2026-124194 | Microsoft Outlook Spoofing Vulnerability | Yes |
CVE-2026-112967 and CVE-2026-116928 are Critical RCE vulnerabilities in Windows services, each carrying a CVSS score of 9.8. Both allow unauthenticated attackers to execute code over the network, though they affect distinct components with different deployment realities.
CVE-2026-112967 is a heap-based buffer overflow in the Windows Xbox Live Networking Service. An in-network attacker can call arbitrary endpoints on the service to trigger the flaw. Enterprise exposure depends on whether the service is present and running. Consumer-oriented Windows SKUs and gaming-enabled configurations are the primary population, making this lower priority for most corporate fleets.
CVE-2026-116928 is an out-of-bounds write in the Windows Search component. The attack path is notable: An unauthenticated attacker can send an email with a specially crafted attachment to an Exchange Server, and the search indexer processes the attachment automatically for indexing. The recipient does not need to open the email or attachment. Successful exploitation grants code execution with the permissions of the indexing service. Windows Search is broadly deployed and tightly integrated with Exchange for mailbox indexing, which places this flaw on an email delivery attack surface that reaches internet-facing mail infrastructure. The Windows Search path is the more significant exposure for enterprise environments. Email-delivered payloads that trigger without user interaction have historically been attractive to targeted intrusion operators because they bypass the phishing-click dependency that slows most initial access campaigns.
| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 9.8 | CVE-2026-112967 | Windows Xbox Live Networking Service Remote Code Execution Vulnerability | Yes |
| Critical | 9.8 | CVE-2026-116928 | Windows Search Remote Code Execution Vulnerability | Yes |
CVE-2026-119958 is a Critical RCE vulnerability in Windows LDAP with a CVSS score of 9.8. The flaw is an out-of-bounds write that allows an unauthenticated attacker to execute arbitrary code by sending specially crafted LDAP calls to a listening server. No authentication or user interaction is required.
LDAP is the directory access protocol that underpins Active Directory. Every domain controller exposes LDAP on TCP/389 (and TCP/636 for LDAPS) by design, and the service cannot be disabled without breaking domain operations. Member servers, workstations, and applications query LDAP continuously for authentication, group policy retrieval, and object lookups, making it one of the most heavily trafficked protocols inside any AD environment.
The scope-of-impact concern is substantial. Code execution within the LDAP service on a domain controller places the attacker inside the trust boundary that every other domain resource relies on. From that position, credential extraction, replication abuse, and lateral movement to additional DCs become straightforward follow-on actions. Because LDAP is network-reachable from any domain-joined host by default, any internal foothold that can route to a DC can attempt exploitation.
Unauthenticated RCE flaws in core AD infrastructure have historically drawn rapid attention from ransomware operators and targeted intrusion actors because they collapse the gap between initial access and domain-wide compromise.
| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 9.8 | CVE-2026-119958 | Windows LDAP - Lightweight Directory Access Protocol RCE Vulnerability | Yes |
Eight Critical RCE vulnerabilities this month share a common attack vector: the Preview Pane in Outlook and Word. All carry CVSS scores of 7.5 to 8.8, with seven of the eight scoring 8.8. The underlying flaw classes are use-after-free (four CVEs), heap-based buffer overflow (two CVEs), release of invalid pointer (one CVE), and use of uninitialized resource (one CVE). Despite the variation in memory-corruption primitives, the exploitation pattern is uniform: An attacker delivers a malicious document or email, and merely selecting it for preview triggers code execution with the user's privileges.
The Outlook vulnerabilities (CVE-2026-110043, CVE-2026-110068, CVE-2026-111309) are the highest-exposure items in this group. Email is the delivery mechanism, and the Preview Pane is enabled by default in most enterprise Outlook deployments. An external attacker who can send mail to a target organization can reach the vulnerable code path without any authentication or prior foothold. The Word vulnerabilities (CVE-2026-110067, CVE-2026-111285, CVE-2026-124185) require document delivery, which typically means a phishing attachment or a link to a malicious file, but still fire on preview rather than open.
The remaining two CVEs (CVE-2026-111289, CVE-2026-120003) affect the broader Office suite and follow the same preview-triggered pattern. CVE-2026-124185 has a lower score (7.5) due to high attack complexity, but the others require no special conditions beyond user receipt of the malicious content.
Preview Pane vulnerabilities have historically been attractive to phishing operators and initial-access brokers because delivery converts directly to execution, with no need to persuade a user to open an attachment.
| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 8.8 | CVE-2026-110043 | Microsoft Office Outlook Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-110067 | Microsoft Office Word Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-110068 | Microsoft Office Outlook Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-111285 | Microsoft Office Word Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-111289 | Microsoft Office Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-111309 | Microsoft Office Outlook Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-120003 | Microsoft Office Remote Code Execution Vulnerability | Yes |
| Critical | 7.5 | CVE-2026-124185 | Microsoft Office Word Remote Code Execution Vulnerability | Yes |
CVE-2026-118146 and CVE-2026-118148 are Critical vulnerabilities in Active Directory Domain Services that both stem from incorrect authorization flaws. The two CVEs share a flaw class but differ in outcome and attack complexity.
CVE-2026-118146 carries a CVSS score of 8.8 and enables RCE. An authenticated attacker with low-level access to an affected server can send a specially crafted request and execute code without any user interaction. The authorization flaw means the server fails to properly validate that the authenticated principal should be permitted to perform the requested operation, turning a low-privilege foothold into code execution on a domain controller.
CVE-2026-118148 has a CVSS score of 7.5 and results in elevation of privilege to SYSTEM. This vulnerability has high attack complexity because successful exploitation requires the attacker to win a race condition. An authenticated attacker who can trigger the race gains SYSTEM privileges on the domain controller.
Active Directory Domain Services provides directory and authentication services for Windows enterprise domains. Domain controllers running AD DS issue Kerberos tickets, store the directory database, and process authentication and authorization decisions for every domain-joined resource. Compromise of a domain controller typically means compromise of the entire domain, since the attacker gains access to credential material and can issue arbitrary authentication assertions.
The attack surface for both vulnerabilities is any domain controller reachable from an authenticated low-privileged foothold. In most enterprise deployments, that includes every writable DC in the forest. Incorrect authorization flaws in identity platform components have historically been attractive to targeted intrusion operators because they convert commodity initial access into domain-wide compromise without requiring credential theft or additional tooling.
| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 8.8 | CVE-2026-118146 | Windows Active Directory Domain Services Remote Code Execution Vulnerability | Yes |
| Critical | 7.5 | CVE-2026-118148 | Active Directory Domain Services Elevation of Privilege Vulnerability | Yes |
CVE-2026-118207 is a Critical RCE vulnerability in Microsoft Exchange Server with a CVSS score of 8.8. The flaw stems from use of an incorrectly resolved name or reference, allowing an authenticated attacker with low-level access to send a specially crafted request and execute code on the server. No user interaction is required.
Microsoft Exchange Server provides enterprise email, calendar, and collaboration services, and is commonly deployed with internet-facing client access services for mobile and web users. The authentication requirement lowers the bar only modestly in most environments: Any compromised mailbox credential, service account, or partner federation relationship satisfies it. Once that requirement is met, the attacker reaches code execution on a server that typically holds sensitive mail content, internal address lists, and often enjoys elevated trust relationships with Active Directory.
Organizations running on-premises Exchange frequently expose Outlook Web Access, Exchange ActiveSync, and Autodiscover endpoints to the internet. Servers in this posture are reachable from any network position once the attacker obtains valid credentials, and successful exploitation yields a foothold inside the perimeter on infrastructure that processes sensitive communications.
Exchange Server vulnerabilities have historically drawn sustained attention from nation-state threat actors and ransomware operators because the combination of internet exposure, high-value data, and domain trust relationships makes compromised Exchange servers effective pivot points for broader intrusions.
| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 8.8 | CVE-2026-118207 | Microsoft Exchange Server Remote Code Execution Vulnerability | Yes |
Microsoft addresses eight Critical elevation of privilege vulnerabilities in Windows Hyper-V this month, spanning five distinct flaw classes: use-after-free (four CVEs), heap-based buffer overflow (one CVE), TOCTOU race condition (one CVE), untrusted pointer dereference (one CVE), and use of uninitialized resource (one CVE). CVSS scores range from 6.4 to 8.2, with CVE-2026-113753 at the top of the range.
The exploitation outcomes fall into two categories. CVE-2026-113753 allows an attacker to gain Virtual Trust Level 1 (VTL1) privileges, which means escaping from the normal kernel (VTL0) into the secure kernel layer that underpins Virtualization-Based Security features such as Credential Guard. Five of the remaining seven CVEs enable guest-to-host escape: An attacker operating inside a guest virtual machine can execute code on the host in the security context of the virtual machine worker process.
Hyper-V is the hypervisor layer that runs Azure compute infrastructure and powers client-side Windows features including Windows Sandbox, Windows Subsystem for Linux 2, and Virtualization-Based Security. The exposure therefore reaches both datacenter server populations and ordinary endpoints where these features are enabled.
Most of the cluster carries a high attack complexity because exploitation requires winning a race condition, which raises the practical difficulty but does not eliminate the risk. Hypervisor escapes of this class have historically attracted attention from advanced adversaries because a successful exploit compromises the isolation boundary that separates tenants in shared infrastructure and protects credential material on endpoints.
| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 8.2 | CVE-2026-113753 | Windows Hyper-V Elevation of Privilege Vulnerability | Yes |
| Critical | 7.8 | CVE-2026-113856 | Windows Hyper-V Elevation of Privilege Vulnerability | Yes |
| Critical | 7.8 | CVE-2026-113865 | Windows Hyper-V Elevation of Privilege Vulnerability | Yes |
| Critical | 7.5 | CVE-2026-113861 | Windows Hyper-V Elevation of Privilege Vulnerability | Yes |
| Critical | 7.5 | CVE-2026-119947 | Windows Hyper-V Elevation of Privilege Vulnerability | Yes |
| Critical | 7.5 | CVE-2026-119960 | Windows Hyper-V Elevation of Privilege Vulnerability | Yes |
| Critical | 7.0 | CVE-2026-113860 | Windows Hyper-V Elevation of Privilege Vulnerability | Yes |
| Critical | 6.4 | CVE-2026-113864 | Windows Hyper-V Elevation of Privilege Vulnerability | Yes |
CVE-2026-119957 is a Critical elevation of privilege vulnerability in Windows Remote Desktop Services with a CVSS score of 7.8. The flaw is a double-free that requires the attacker to win a race condition. Although exploitation is local, successful exploitation allows an attacker operating inside a guest virtual machine to escape to the host and gain the privileges of the affected virtualization service.
Remote Desktop Services underpins RDP-based remote administration across Windows Server deployments and is a core component in Virtual Desktop Infrastructure (VDI) environments. The guest-to-host escape path described in Microsoft's FAQ elevates this from a local privilege escalation to a potential hypervisor boundary violation, which matters in any multi-tenant or shared-host scenario.
The attack complexity is high due to the race condition. Post-compromise scenarios where an attacker already controls a guest VM provide the dwell time needed to attempt exploitation repeatedly. RDS-based session hosts and VDI pools present the most exposure to this guest-to-host escalation path.
| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 7.8 | CVE-2026-119957 | Windows Remote Desktop Services Elevation of Privilege Vulnerability | Yes |
CVE-2026-113825 is a Critical RCE vulnerability in the Windows SMB Server Network Transport Driver (srvnet.sys) with a CVSS score of 7.5. The flaw is a race condition that an authenticated attacker can trigger over the network to execute code. Microsoft notes that successful exploitation requires the attacker to win the race, which accounts for the high attack-complexity rating.
SMB is the native file-sharing protocol for Windows and is enabled by default on both client and server editions. The srvnet.sys driver handles the network transport layer for SMB traffic, sitting beneath the higher-level SMB2 and SMB3 protocol handlers. SMB listens on TCP/445 and is fundamental to domain operations such as SYSVOL replication, Group Policy delivery, and administrative shares.
The authentication requirement limits drive-by exploitation from the internet, but any attacker who has already obtained low-privileged domain credentials, or who operates from a compromised workstation, can attempt the race. Timing-based flaws in kernel-mode network drivers can be unreliable on a single attempt, yet become practical when an attacker can retry at scale across many hosts. Ransomware operators and targeted intrusion operators have historically exploited race-condition RCE flaws in legacy network services for lateral movement and wormable propagation.
| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 7.5 | CVE-2026-113825 | Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability | Yes |
CVE-2026-113752 is a Critical RCE vulnerability in Windows Print Spooler with a CVSS score of 7.5. The flaw is a use-after-free that an unauthenticated attacker can trigger over an adjacent network. Successful exploitation requires winning a race condition, which raises the practical difficulty but does not eliminate the risk in contested LAN environments.
Windows Print Spooler manages print job queuing and driver loading on Windows endpoints and servers. It runs with SYSTEM privileges by default and is enabled on virtually every Windows installation, including workstations that have no physical printer attached. The adjacent-network attack vector limits exposure to attackers who already have a foothold on the same network segment, but that constraint is often satisfied during post-compromise lateral movement.
Print Spooler vulnerabilities have historically drawn sustained attacker attention because the service combines broad default deployment, high privilege, and a complex legacy codebase that has repeatedly yielded exploitable flaws.
| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 7.5 | CVE-2026-113752 | Windows Print Spooler Components Remote Code Execution Vulnerability | Yes |
The following notable vulnerabilities were considered but did not warrant a dedicated deep-dive this month:
Microsoft addressed 2 additional Critical or high-CVSS-rated vulnerabilities in its cloud services this month. These have been mitigated server-side by Microsoft and require no customer action. They are listed here for awareness only:
For a visual overview of the systems impacted by this month’s vulnerabilities, you can use our Patch Tuesday dashboard. This can be found in the CrowdStrike Falcon® platform within the Exposure Management > Vulnerability Management > Dashboards page. The preset dashboards show the most recent three months of Patch Tuesday vulnerabilities.
The CrowdStrike Falcon platform regularly collects and analyzes trillions of endpoint events every day from millions of sensors deployed across 176 countries. Watch this demo to see the Falcon platform in action.
With CrowdStrike Falcon® Exposure Management, you can automatically classify and prioritize assets, show attack paths targeting client-side exploitation of devices, and integrate with CrowdStrike Falcon® Next-Gen SIEM. Learn more in this blog post:
Falcon Exposure Management’s AI-Powered Risk Prioritization Shows Organizations What to Fix First
Learn more about how CrowdStrike Falcon® Exposure Management can help you quickly and easily discover and prioritize vulnerabilities and other types of exposures here.
As we have learned with other notable vulnerabilities, such as Log4j, not every highly exploitable vulnerability can be easily patched. As is the case for the ProxyNotShell vulnerabilities, it’s critically important to develop a response plan for how to defend your environments when no patching protocol exists.
Regular review of your patching strategy should still be a part of your program, but you should also look more holistically at your organization's methods for cybersecurity and improve your overall security posture.
The Common Vulnerability Scoring System (CVSS) is a free and open industry standard that CrowdStrike and many other cybersecurity organizations use to assess and communicate software vulnerabilities’ severity and characteristics. The CVSS Base Score ranges from 0.0 to 10.0, and the National Vulnerability Database (NVD) adds a severity rating for CVSS scores. Learn more about vulnerability scoring in this article.
Try CrowdStrike free today
Sign up now to receive the latest notifications and updates from CrowdStrike
