Microsoft's November Patch Tuesday Fixes 1,235 CVEs as Application Patching Pressures Grow

Key Takeaways

• Microsoft's November 2026 Patch Tuesday fixed 1,235 CVEs. It is the second-largest release ever, behind October's 1,413, and the third month in a row with 1,000 or more.
• The actively exploited zero-day highlights the application readiness challenge. The Outlook vulnerability exposes NTLMv2 authentication information and affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. For enterprises, the challenge isn't simply deploying Microsoft's fix. It's knowing which application versions are affected, validating compatibility and ensuring remediation happens quickly without disrupting users.
• It isn't only Microsoft. SAP shipped its largest-ever Patch Day on the same day.
• A major US bank has brought in around 1,000 contractors to patch flaws surfaced by AI models, including Claude Mythos. Most organizations can't respond that way.
• Application patching has to run as a continuous, automated flow, with skilled people focused on the exceptions.

June Marked the Start of a Continued Rise

In June, we wrote about 206 CVEs in a single Patch Tuesday, the largest total in the program's 23-year history at the time. We argued it marked the end of casual application patching.

Five months later, Microsoft's November release fixed 1,235 vulnerabilities. That is six times June's "record", and it isn't even the biggest month of the year. October's 1,413 holds that title.

September, October and November have now each landed near or above 1,000 CVEs. Microsoft has passed 5,000 CVEs in 2026, compared with just over 1,100 in all of 2025.

The most telling thing about November is the reaction. A month that would have been front-page news in 2025 barely registered as a surprise. 

Infosecurity Magazine, Rapid7, CyberScoop, CrowdStrike · counts vary slightly by methodology

Why November's Count Is Important

Three Consecutive Months of High Vulnerability Volumes

A single month of unusually high vulnerability numbers could be considered an outlier, but three consecutive months point to a sustained increase. Rapid7 has indicated that Patch Tuesday volumes are unlikely to return to pre-2026 levels, with November's figures reinforcing that view.

Of the CVEs reported in November, 536 relate to privilege escalation, 296 to remote code execution, and 157 to information disclosure. A total of 66 vulnerabilities are rated Critical.

The Zero-Day Lives In An Application

The one flaw under active attack, CVE-2026-124194, is a spoofing bug in Outlook. An attacker sends a crafted message file. Once it's opened, Outlook connects to an attacker-controlled location without the usual external-content warning, and that connection can leak the user's NTLMv2 hash.

It affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. It is rated only "moderate", yet Action1's Jack Bicer advised pushing the Office update to every Outlook user now, starting with administrators and high-value accounts.

This is not a cumulative OS update that rolls out on its own. It means updating an application on every device that runs it. That includes LTSC installs, VDI and golden images, and the machines that drifted off the standard build years ago. A severity score alone would have put this one near the back of the queue. 

The Increase Extends Beyond Microsoft

SAP also recorded its largest Patch Day to date, addressing 43 vulnerabilities, including 12 classified as Hot News and four with the maximum CVSS score of 10.0. According to Onapsis, this was twice the 2026 average.

For enterprise IT teams, the challenge extends well beyond Microsoft and SAP. Security updates across browsers, runtimes, and business-critical applications all need to be assessed, prioritized, tested, and deployed. With vulnerability volumes increasing across multiple vendors, application teams face a growing workload and greater pressure to deliver updates quickly.

You Can't Hire Your Way Out Of This

In October, a major US bank disclosed that it had brought in around 1,000 outside contractors to patch software flaws surfaced by advanced AI models, including Claude Mythos. The work covers both its own code and the vendor software it runs, and there is no published end date.

For an organization of that size and risk profile, that is a rational response. It also clearly signals what this wave costs in practice. The downstream work of AI-assisted discovery that we described in May now has a headcount attached.

Two words in that story matter most to application teams: vendor software. Every third-party fix still has to be found, sourced, packaged, tested, published, and evidenced across the estate. That is the application team's queue, and it doesn't shrink because the advisory was written by a vendor.

Most organizations can't add a thousand people. Those that can still face the same problem next month, because November added another 1,235 CVEs to the pile. The strain is already showing: Socura found that 22% of UK CISOs have called in sick or booked leave to avoid Patch Tuesday.

The question for everyone else is how to absorb the same flow of change with the team they already have.

From Casual Patching To Continuous Flow

In June, we said casual application patching was ending. At 1,000-plus CVEs a month, prioritization alone stops being a strategy and becomes backlog management. The backlog never gets a quiet month to clear.

The teams that cope treat application updates like a production line, not a monthly event:

1. Know what's actually deployed. That means versions, not just product names, across LTSC installs, VDI images, and the apps no patch catalog covers.
2. Triage by exploitability and exposure, not raw count. November's most urgent flaw was rated "moderate". Volume is noise; what's exploited and what's installed is signal.
3. Automate the repeatable path. Source the installer, package it, test install, launch and uninstall, then publish. Routine updates should flow through without a packager touching every step.
4. Route business validation to the people who own the app. Clear ownership and sign-off stop testing from becoming the bottleneck.
5. Measure the flow. Track time from vendor release to deployed, and how many updates needed a human. Those numbers tell you whether you can absorb the next record month.

Human judgment still matters for risk acceptance, sequencing, and true exceptions. It just can't be required for every step of every update.

How Juriba Helps

Juriba is built for the gap between "a vendor shipped a fix" and "it's safely deployed everywhere it needs to be".

• Juriba App Readiness automates the repeatable packaging and testing work: wrapping updates, PSADT support, and validating install, launch, and uninstall behavior at volume. Routine updates flow through, and your packagers focus on the awkward apps, gated downloads, and true exceptions.
• It covers the apps catalogs don't. That includes niche, legacy, internal, and loose-file applications, so the long tail of your estate doesn't fall back to tickets and spreadsheets.
• Juriba App Owner puts business validation in the hands of the people who own each application, with clear ownership and sign-off. Testing keeps pace instead of becoming the bottleneck.

The result is an operating model that absorbs a 1,000-CVE month without 1,000 extra people.

Further reading: The Coming Application Update Wave

Frequently asked questions

How many vulnerabilities did Microsoft fix in November 2026's Patch Tuesday?

1,235, including one actively exploited zero-day in Outlook (CVE-2026-124194) and 66 Critical flaws. It is the second-largest Patch Tuesday on record, after October 2026's 1,413.

Is November's Patch Tuesday a record?

It isn't the largest month: October holds that record. But it is the third consecutive month near or above 1,000 CVEs, and 2026's total has now passed 5,000. The sustained volume matters more than any single peak.

Why does the Outlook zero-day matter for application teams?

The fix is an Office application update, not a Windows cumulative update. It has to reach every device running Microsoft 365 Apps for Enterprise or Office LTSC 2021 and 2024, including VDI images and non-standard builds.

Why are Patch Tuesdays so much bigger in 2026?

AI-assisted vulnerability discovery, including models such as Claude Mythos, is finding flaws faster across the industry. More discoveries mean more vendor fixes, and more application updates for enterprise teams to package, test, and deploy.

How does Juriba help?

Juriba App Readiness automates repeatable packaging and testing so routine updates flow through continuously. Juriba App Owner adds ownership and business sign-off, so specialists can focus on exceptions and risk-based decisions.