Microsoft: November Patch Tuesday

Windows

Microsoft released updates to fix over 1,000 security vulnerabilities

Do this now

Check the vendor advisory for a fixed version before you assume one exists.

Who should check: teams running Windows

First seen: 10 Nov 2026
Last update: 11 Nov 2026, 09:17 UTC
Source: news
On the menu as: Windows

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Microsoft: November Patch Tuesday
Severity: unknown. Patch status: patched.
Affected: Windows

Microsoft released updates to fix over 1,000 security vulnerabilities

## Steps
1. This touches infrastructure (windows). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://krebsonsecurity.com/2026/11/microsoft-fixes-nearly-1100-security-vulnerabilities/ https://www.darkreading.com/vulnerabilities-threats/november-patch-tuesday-cornucopia-cves https://www.theregister.com/security/2026/11/10/november-patch-tuesday-boasts-over-1000-bugs-but-only-one-zero-day-so-far/5308946 https://securityaffairs.com/202839/hacking/microsoft-november-patch-tuesday-one-exploited-outlook-bug-and-30-wormable-flaws.html
https://pwned.coffee/i/microsoft-november-patch-tuesday

Timeline

10 Nov 2026, 23:17 UTC
Fix status: unknown → patched.
10 Nov 2026, 23:17 UTC
Reported by darkreading.com: November Patch Tuesday: An Overflowing Cornucopia of CVEs
10 Nov 2026, 22:18 UTC
Fix status: patched → unknown.
10 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Checked by hand “Microsoft Security Update Guide, November 2026 Security Updates release notes (read 11 Nov 2026, 15:37 UTC): "The updates are available via the Microsoft Update Catalog." Microsoft rates each CVE, not the month, and this ticket carries none, so its severity is unknown.” source
Overheard “Microsoft serves up an actively exploited Outlook zero-day, and a wave of critical Exchange, SharePoint, Windows Search, and LDAP bugs that exhausted defenders need to prioritize fast.” source
Score: Severity unknown, checked by hand: Microsoft Security Update Guide, November 2026 Security Updates release notes (read 11 Nov 2026, 15:37 UTC): "The updates are available via the Microsoft Update Catalog." Microsoft rates each CVE, not the month, and this ticket carries none, so its severity is unknown.
Last checked: 13 Nov 2026, 16:26 UTC

Sources: KEV – CVE record – Vendor ✓

Sources

Follow on X

Totalone coffee