Virtual Administrator’s November 2026 Patch Recommendations
All new patches will be approved in our patch policy.
This month Microsoft released patches for 1,235 vulnerabilities with 66 rated “Critical” in severity.
“Only” 1,235 flaws this month. One is being actively exploited. This is a Microsoft Outlook zero-day vulnerability CVE-2026-124194.
- Microsoft release some Out-of-band on October 26th.
- The preview CUs were released on October 28th and the Windows 11 preview KB5127936 was failing to install but this should have been corrected with the full CU KB5132061 – see “Known Issues” below.
- Server 2012/2012R2 is no longer support with ESU but Microsoft did release a “final” patch on November 6th.
- New standalone SSUs for Windows 10 1607/Server 2016 and Server 2012/2012R2.
Last month’s “Exchange Server OWA” and “USB Audio device error Code 10” have been resolved.
Disclosed: None
Exploited: CVE-2026-124194
Security Update Guide
https://msrc.microsoft.com/update-guide/en-us
Microsoft Security Advisories
ADV990001 | Latest Servicing Stack Updates (Published:3/1/2018 | Last Updated: 11/10/2026)
https://msrc.microsoft.com/update-guide/en-us/vulnerability/ADV990001
Reason for Revision: A Servicing Stack Update has been released for some versions of Windows.
NOTE: The Windows 10 Security Stack Updates are included in the monthly Cumulative Updates.
Known Issues
There are a few issues this month listed below.
Microsoft continues to list unresolved older problems under the Known Issues for new patches. So if you have not yet experienced one of these issues it is unlikely it will occur now.
Good resource for known issues with Windows 10/11/Server patches. Find the version and click on “Known issues”.
Windows release health
https://docs.microsoft.com/en-us/windows/release-health/
November Preview update KB5127936 installation may fail. This should have already been corrected by Microsoft.
“November security update might fail to install on some devices”
Symptoms: When attempting to install the November 2026 Windows security update KB5127936, some devices might be unable to complete the installation. Affected devices might repeatedly attempt to install the update or display error code 0x80070306, 0x800f0989, or 0x800f0993.
Resolution: The resolution for this issue is automatically running in affected devices connected to the internet and using Windows Update in Settings to install updates. No manual action from end-users is required to receive the repair. All affected devices should be repaired in 24 to 48 hours starting from November 11, 2026, 10am PT. Once your device receives the repair, it will automatically download and install the November 2026 security update via Windows Update. You can also install the update by following these instructions. We will update this documentation once the resolution rollout is completed.
“Access violation when you query sys.dm_exec_requests during database recovery”
KB5129299 – Description of the security update for SQL Server 2025 CU10
https://support.microsoft.com/en-us/servicing/sql/sql-server-2025/cumulative-update/kb5129299-cu10-gdr-november-2026
KB5129300 – Description of the security update for SQL Server 2022 CU27
https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026
Affects: SQL Server 2022/2025
Symptoms: Queries against sys.dm_exec_requests might raise an access violation and generate a dump file if they run while a database is still recovering. This issue can occur during a database RESTORE operation, during startup recovery, or before an availability group replica finishes coming online.
Mitigation: Microsoft is aware of this issue and is investigating a fix. Until a fix is available, use one of the following mitigations:
- Enable trace flag 4696 to opt out of the code change that causes this issue. If you enable this trace flag, monitoring queries that query sys.dm_exec_requests or sys.sysprocesses on secondary replicas might return error 976 or error 978, as they did before you installed this update.
- Avoid queries against sys.dm_exec_requests for databases that are recovering.
- Uninstall this update.
“Windows activation and licensing commands might fail with error 0x80041008”
Affects: Windows 10 21H2/22H2, Windows 11 23H2, Windows Server 2019/2022/2025
Symptoms: After installing the November 2026 Windows security update, certain Windows activation and licensing operations performed using the Software Licensing Management Tool might fail.
Affected devices might encounter error 0x80041008, Invalid parameter (SWbemObjectEx), when running commands to activate Windows, configure Key Management Service (KMS), or manage product keys. The failure has been observed while executing the following commands:
slmgr.vbs /skms-domain <domain>
slmgr.vbs /ipk <key>
This issue primarily affects organizations that use command-line tools or automated processes to manage Windows activation and licensing.
Devices that are already activated remain activated. Customers whose devices already have the appropriate KMS client key and KMS configuration, and who do not need to run the affected Slmgr.vbs commands, are not expected to be affected.
Devices that are being configured to use KMS activation might encounter errors when attempting to initiate their activation. KMS-activated devices typically remain activated for up to 180 days following successful activation. Customers who have the KMS client key already installed in their image and do not use slmgr for further configurations are unaffected.
Workaround: A workaround is available for organizations that need an immediate mitigation. Please contact Microsoft Support for business. We are working on a resolution that will be available in the coming days. We will update this documentation when it becomes available.
Status: Microsoft has stated that a fix is expected to be released in the coming days
Monthly Rollup/Security Only/Windows 10,11/Server 2016,2019,2022,2025 KBs
Links are https://support.microsoft.com/en-us/help/####### with the KB number only.
Security and Quality Rollup
- KB5135582 – Windows Server 2012 R2 (11/6 Out-of-band)
- KB5135580 – Windows Server 2012 (11/6 Out-of-band)
Cumulative Updates
Windows 10
- KB5131096 – Version 21H2 “November 2021 Update” (OS Build 19044) (ESU)
- KB5131096 – Version 22H2 “November 2022 Update” (OS Build 19045) (ESU)
(Versions 1507,1511,1607,1703,1709,1803,1809,1903,1909,2004,20H2,21H1 are no longer under support)
Windows 11
- KB5131087 – 23H2 (OS Build 22631)
- KB5132061 – 24H2 (OS Build 26100)
- KB5132061 – 25H2 (OS Build 26200)
- KB5132059 – 26H1 (OS Build 28000)
- KB5132061 – 26H2 (OS Build 26300)
(Version 21H2,22H2 are no longer under support)
Windows Server
- KB5131291 – Server 2016 (EOS January 2027)
- KB5131085 – Server 2019 (EOS January 2029)
- KB5131090 – Server 2022 (OS Build 20348)
- KB5131080 – Server 2025 (OS Build 26100)
November 2026 updates for Microsoft Office
https://support.microsoft.com/en-us/servicing/office/hotfix/index/5134569
Notable CVEs
CVE-2026-113859 | Windows TCP/IP Remote Code Execution Vulnerability (Cumulative Update)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-113859
Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network. Successful exploitation of this vulnerability requires an attacker to win a race condition.
CVE-2026-118146 | Windows Active Directory Domain Services remote code execution vulnerability (Cumulative Update)
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-118146
Incorrect authorization in Active Directory Domain Services allows an authorized attacker to execute code over a network. An authenticated attacker with low-level access to an affected server could send a specially crafted request to execute code on the server. User interaction is not required.
CVE-2026-118207 | Microsoft Exchange Server remote code execution vulnerability (KB5133453)
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-118207
An authenticated attacker with low-level access to an affected server could send a specially crafted request to execute code on the server. User interaction is not required.
CVE-2026-119952 | Windows Schannel remote code execution vulnerability (Cumulative Update)
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-119952
Observable timing discrepancy in Windows Schannel allows an unauthorized attacker to execute code over a network. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
CVE-2026-119958 | Windows LDAP – Lightweight Directory Access Protocol Remote Code Execution Vulnerability (Cumulative Update)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119958
Out-of-bounds write in Windows LDAP – Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network. An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through a specially crafted set of LDAP calls to execute arbitrary code within the context of the LDAP service.
CVE-2026-120002 | Microsoft SharePoint Server elevation of privilege vulnerability (KB5002945)
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-120002
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-124194 | Microsoft Outlook spoofing vulnerability
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. The Preview Pane is not an attack vector.
