Microsoft Fixes Nearly 1,100 Security Vulnerabilities

Microsoft fixed 1,093 vulnerabilities this month, including 63 critical flaws and one Outlook zero-day that attackers already exploit. Install the November Windows and Office updates now, then update your browsers and Apple devices. The details come from Krebs on Security.

What Microsoft shipped this Patch Tuesday

The release covers Windows and supported Microsoft software. Of the 1,093 fixes, 63 are rated "critical." These are flaws that can let an attacker seize control of a Windows system with little or no help from users.

Nearly half of the critical bugs are remote code execution flaws. Overall, 535 of the fixed flaws let an attacker elevate privileges on a vulnerable device.

The volume keeps climbing. Microsoft has now shipped more than 5,100 security patches this year. A year ago it averaged around 100 per month, and last month it pushed more than 1,400 fixes. Microsoft credits advances in artificial intelligence for finding and fixing so many bugs.

Who needs to update, and to what

Almost everyone running Windows or Office is affected. Other vendors also released fixes this week, so your browsers and phones need attention too.

Apple also backported its fix to iOS 18. Neely said he takes notice when Apple fixes more than two versions, and advised setting an upgrade date for hardware that cannot run the current version.

How serious it is and what is exploited

Microsoft says only one flaw is under active exploitation: CVE-2026-124194, a spoofing bug in Outlook. Its advisory lists Microsoft 365 Apps for Enterprise and editions of Microsoft Office as affected. Check that advisory for the exact fixed build for your edition.

Chrome's CVE-2026-125350 is the sixth Chrome zero-day this year. It is also being patched in Chromium-based browsers like Edge. Adobe says it has no evidence that any of its flaws are being exploited.

Big numbers can mislead. Ivanti's Chris Goettl notes that about 95,000 vulnerabilities received CVEs this year, but only 217 have reached CISA's Known Exploited Vulnerabilities (KEV) list. Roughly four in ten exploited flaws sit in operating systems, endpoint software, browsers and server platforms. Another 44% sit in edge devices and IT management or remote access tools.

Patch and verify your devices

Back up important data first, ideally before you apply operating system updates. Then run Windows Update and your Office update channel.

On Windows, confirm that recent updates installed:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, Description, InstalledOn

To pull an Office update on a Click-to-Run install, such as Microsoft 365 Apps:

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user

Check browser versions against the table above:

(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
(Get-Item "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe").VersionInfo.ProductVersion
& "C:\Program Files\Mozilla Firefox\firefox.exe" --version

On a Mac, check the OS version and list pending updates. Neely's advice applies: do not assume the fixes went out automatically.

sw_vers
softwareupdate --list

Paths differ if you installed the apps elsewhere. In managed fleets, run the same checks through your endpoint management tool instead of device by device.

A triage order for a busy week

You cannot test 1,093 fixes one by one. Patch by exposure and evidence of attack instead.

Here is a worked example. Say you manage 40 laptops. On day one, push the Office and browser updates. Within the week, deploy the Windows updates to a pilot group and then to everyone. Keep a list of laptops that missed the update and chase each one.

What IT and security learners can take from this

This month shows why patch management is a core skill, not a chore. You need to read advisories, rank risk by exploitation, and verify results. Goettl's split between patching and exposure management is a useful mental model.

If you want a structured path into this work, Microsoft's security operations track covers detection and response with Kusto Query Language (KQL). Our SC-200 exam guide lays out the skills and a study plan. You can also browse our cybersecurity certifications. When you are ready to book, the SC-200 voucher costs $44.99 and arrives by email within 12 hours.

Sources

• Microsoft Fixes Nearly 1,100 Security Vulnerabilities (Krebs on Security)