In June, we wrote about 206 CVEs in a single Patch Tuesday, the largest total in the program's 23-year history at the time. We argued it marked the end of casual application patching.
Five months later, Microsoft's November release fixed 1,235 vulnerabilities. That is six times June's "record", and it isn't even the biggest month of the year. October's 1,413 holds that title.
September, October and November have now each landed near or above 1,000 CVEs. Microsoft has passed 5,000 CVEs in 2026, compared with just over 1,100 in all of 2025.
The most telling thing about November is the reaction. A month that would have been front-page news in 2025 barely registered as a surprise.
A single month of unusually high vulnerability numbers could be considered an outlier, but three consecutive months point to a sustained increase. Rapid7 has indicated that Patch Tuesday volumes are unlikely to return to pre-2026 levels, with November's figures reinforcing that view.
Of the CVEs reported in November, 536 relate to privilege escalation, 296 to remote code execution, and 157 to information disclosure. A total of 66 vulnerabilities are rated Critical.
The one flaw under active attack, CVE-2026-124194, is a spoofing bug in Outlook. An attacker sends a crafted message file. Once it's opened, Outlook connects to an attacker-controlled location without the usual external-content warning, and that connection can leak the user's NTLMv2 hash.
It affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. It is rated only "moderate", yet Action1's Jack Bicer advised pushing the Office update to every Outlook user now, starting with administrators and high-value accounts.
This is not a cumulative OS update that rolls out on its own. It means updating an application on every device that runs it. That includes LTSC installs, VDI and golden images, and the machines that drifted off the standard build years ago. A severity score alone would have put this one near the back of the queue.
SAP also recorded its largest Patch Day to date, addressing 43 vulnerabilities, including 12 classified as Hot News and four with the maximum CVSS score of 10.0. According to Onapsis, this was twice the 2026 average.
For enterprise IT teams, the challenge extends well beyond Microsoft and SAP. Security updates across browsers, runtimes, and business-critical applications all need to be assessed, prioritized, tested, and deployed. With vulnerability volumes increasing across multiple vendors, application teams face a growing workload and greater pressure to deliver updates quickly.
In October, a major US bank disclosed that it had brought in around 1,000 outside contractors to patch software flaws surfaced by advanced AI models, including Claude Mythos. The work covers both its own code and the vendor software it runs, and there is no published end date.
For an organization of that size and risk profile, that is a rational response. It also clearly signals what this wave costs in practice. The downstream work of AI-assisted discovery that we described in May now has a headcount attached.
Two words in that story matter most to application teams: vendor software. Every third-party fix still has to be found, sourced, packaged, tested, published, and evidenced across the estate. That is the application team's queue, and it doesn't shrink because the advisory was written by a vendor.
Most organizations can't add a thousand people. Those that can still face the same problem next month, because November added another 1,235 CVEs to the pile. The strain is already showing: Socura found that 22% of UK CISOs have called in sick or booked leave to avoid Patch Tuesday.
The question for everyone else is how to absorb the same flow of change with the team they already have.
In June, we said casual application patching was ending. At 1,000-plus CVEs a month, prioritization alone stops being a strategy and becomes backlog management. The backlog never gets a quiet month to clear.
The teams that cope treat application updates like a production line, not a monthly event:
Human judgment still matters for risk acceptance, sequencing, and true exceptions. It just can't be required for every step of every update.
Juriba is built for the gap between "a vendor shipped a fix" and "it's safely deployed everywhere it needs to be".
The result is an operating model that absorbs a 1,000-CVE month without 1,000 extra people.
Further reading: The Coming Application Update Wave
1,235, including one actively exploited zero-day in Outlook (CVE-2026-124194) and 66 Critical flaws. It is the second-largest Patch Tuesday on record, after October 2026's 1,413.
It isn't the largest month: October holds that record. But it is the third consecutive month near or above 1,000 CVEs, and 2026's total has now passed 5,000. The sustained volume matters more than any single peak.
The fix is an Office application update, not a Windows cumulative update. It has to reach every device running Microsoft 365 Apps for Enterprise or Office LTSC 2021 and 2024, including VDI images and non-standard builds.
AI-assisted vulnerability discovery, including models such as Claude Mythos, is finding flaws faster across the industry. More discoveries mean more vendor fixes, and more application updates for enterprise teams to package, test, and deploy.
Juriba App Readiness automates repeatable packaging and testing so routine updates flow through continuously. Juriba App Owner adds ownership and business sign-off, so specialists can focus on exceptions and risk-based decisions.