Microsoft Patch Tuesday, November 2026: the CVEs
Filter
Microsoft Patch Tuesday November 2026: the CVEs Microsoft published on 10 November 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Oct 2026, Sep 2026, Aug 2026, Jul 2026, Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday
- 9.8CVE-2026-96157EPSS 0.9%
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
- 9.8CVE-2026-96078EPSS 1.0%
Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
- 9.8CVE-2026-96067EPSS 0.9%
Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
- 9.0CVE-2026-95962EPSS 0.7%
Use after free in Windows Virtual Filtering Platform (VFP) allows an unauthorized attacker to execute code over a network.
- 9.8CVE-2026-95901EPSS 1.0%
Double free in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.
- 9.8CVE-2026-95882EPSS 1.0%
Stack-based buffer overflow in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.
- 9.8CVE-2026-88243EPSS 1.0%
Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
- 9.8CVE-2026-88234EPSS 0.9%
Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.
- 9.8CVE-2026-88218EPSS 1.1%
Double free in Windows DNS allows an unauthorized attacker to execute code over a network.
- 9.8CVE-2026-85844EPSS 1.0%
Authentication bypass using an alternate path or channel in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.
- 9.0CVE-2026-80095EPSS 0.8%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- 9.8CVE-2026-66801EPSS 1.1%
Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.
- 9.6CVE-2026-120779EPSS 0.6%
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- 9.9CVE-2026-120002EPSS 0.9%
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- 9.8CVE-2026-119990EPSS 0.9%
Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.
- 9.8CVE-2026-119958EPSS 1.3%
Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
- 9.1CVE-2026-118740EPSS 0.9%
Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.
- 9.8CVE-2026-116945EPSS 1.2%
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
- 9.8CVE-2026-116928EPSS 1.2%
Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
- 9.1CVE-2026-114162EPSS 0.9%
Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.
- 9.8CVE-2026-114160EPSS 0.9%
Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.
- 9.0CVE-2026-114146EPSS 0.8%
Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- 9.8CVE-2026-112967EPSS 1.2%
Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.
- 9.9CVE-2026-109467EPSS 0.7%
Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.
- 9.0CVE-2026-109454EPSS 0.8%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.