Microsoft November 2026 security update data read November 12, 2026; release November 10, 2026, revised November 11, 2026
1,093, 1,235 or 1,417: Microsoft Own Data Settles the Patch Tuesday Count, and the Answer Is a Counting Rule
Two days after release, the argument about how big November Patch Tuesday was can be closed with Microsoft own numbers. Read on November 12, Microsoft November 2026 security update data lists 1,417 CVE entries, and the spread among the published totals is a counting rule, not a disagreement: 1,093 entries cover Microsoft products other than Edge and Azure Linux, which is the figure Tenable published; Edge accounts for 220 entries and Azure Linux for 104; BleepingComputer counted 1,235 flaws released on Patch Tuesday itself, excluding 108 fixed earlier in November. The document also grew after release day, because 81 entries carry a November 11 initial release date. Senserva, working from the same MSRC data, counts 27 update articles and 70 Critical severity CVEs, with exactly one already exploited: CVE-2026-124194, the Outlook spoofing flaw scored 6.5 and rated Moderate, fixed through the Office channel in builds 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024. Behind it, the highlighted list rewards reading past the exploited line: CVE-2026-120002, a SharePoint Server elevation of privilege scored 9.9 under an Important label and rated Exploitation Less Likely; CVE-2026-119958, a Windows LDAP remote code execution flaw scored 9.8; and two flaws Microsoft rates Exploitation More Likely, CVE-2026-118146 in Active Directory Domain Services, scored 8.8, and CVE-2026-119952 in Windows Schannel, scored 8.1. Exchange Server Subscription Edition carries its own update, KB5133453, covering nine Exchange CVEs. One gap to track: as of November 11, Microsoft Edge on desktop had no listed fix for the Chrome use-after-free flaw CVE-2026-125350, which Google fixed in Chrome 157 on November 9 and which carries the same November 24 KEV deadline as the Outlook flaw.
Executives
When three totals circulate for one release, ask which counting rule produced the number in front of you before asking whether it is good or bad. The decision-grade facts are narrower: one exploited flaw, in Outlook, patched through a channel many dashboards do not watch; 70 Critical entries; and domain controllers, SharePoint and Exchange each carrying named high-score flaws. Ask for deployment evidence by product, with Office build numbers stated, rather than a single percentage for the month.
CIO / CISO
Sequence the remainder of the month from Microsoft own exploitability labels. After the Outlook fix, the two Exploitation More Likely entries, Active Directory Domain Services and Schannel, belong ahead of higher-scored but less likely items on exposed systems, with the SharePoint 9.9 and the LDAP 9.8 next by exposure. Put the Edge question on the risk register explicitly: if Edge is your managed browser, the Chrome flaw fix status is a tracked item with a named owner until Microsoft lists one, not an assumption borrowed from Chrome patching.
Engineers
Prove the Office channel separately: endpoints must show build 16.0.14334.21048 on LTSC 2021 or 16.0.17932.21140 on LTSC 2024, or the fixed Microsoft 365 Apps build, because the Windows cumulative update does not close the exploited flaw. Apply KB5133453 to Exchange Server Subscription Edition, patch domain controllers for the LDAP and Active Directory flaws, and complete the restarts that activate the fixes, verifying authentication and replication afterward. Recheck the MSRC guide before closing the month; 81 entries arrived a day after release, so a freeze on day one data understates the release.
Everyone (non-IT)
The count argument has a practical translation for your own machine: run Windows Update, restart, and then update Office from inside Outlook or Word, because the exploited flaw is fixed there. If your work browser is Edge, watch for its update separately this month and relaunch when it arrives. A restart you postpone is a patch that has not taken effect yet, whichever total your IT team quotes.