Patch Tuesday: why your report says 1,252 and Microsoft says 1,094

If you pulled two November Patch Tuesday summaries into the same change ticket this week, they disagreed. Tenable counted 1,093 CVEs. Rapid7 counted 1,092. SOCRadar counted 1,094. CrowdStrike counted 1,252. That is a spread of 160 between the lowest and highest published figures for the same release, which is enough to make a patch report look wrong to anyone reading it.

Microsoft's own release note settles it in two lines. "This release consists of 1094 Microsoft CVEs", it says. Then, separately, it notes that it is also republishing 165 CVEs that are not Microsoft's own, with Chrome's not listed at all.

So there are two defensible totals. Microsoft's own flaws come to 1,094. Add the republished third-party advisories and you get 1,259. Everything published this week sits between those two poles depending on what the counter chose to include. Microsoft's product family table backs its own figure exactly: Windows 726, Office 174, SQL Server 59, Developer Tools 53, SharePoint Server 27, Other 25, Azure 20, Exchange Server 9 and Defender 1 add up to 1,094.

CrowdStrike's higher number has a visible mechanism. Its product breakdown counts Extended Security Updates as a category of their own, listing Windows at 745, ESU at 658 and Office at 201. Those three alone come to 1,604, well past the size of the whole release, which is what happens when the same CVE is counted once for a supported platform and again for an ESU one. CrowdStrike does not explain the difference, so treat that as the apparent reason rather than a stated one.

Two of the published tallies also disagree with themselves. Rapid7 gives 1,092 as its total but cites 1,102 Windows CVEs, a figure larger than the total it is part of. Tenable labels CVE-2026-120002, a SharePoint elevation of privilege at CVSSv3 9.9, Critical in a heading and important in the body text. Neither is a reason to distrust the analysis, but both are a reason to quote Microsoft's number in your own ticket and footnote the rest.

The one that is being exploited

There is a single exploited flaw this month: CVE-2026-124194, a spoofing vulnerability in Outlook. Microsoft's release note marks it Exploitation Detected, and Tenable reads Microsoft as saying the attacks came before the patch existed.

It is rated Moderate, with a CVSSv3 score of 6.5, and that rating is the trap. A crafted Office file, once opened, makes Outlook reach out to an attacker-controlled network location without the external-content warning a user would normally see, and hands over the victim's NTLMv2 hash. Tenable's description of what happens next is the important part: the hash can then be used to impersonate that user in follow-on attacks. A moderate-rated spoofing bug that yields working credentials is not a moderate problem.

Two operational details decide how you deploy it. CrowdStrike states that the Preview Pane is not an attack vector for this CVE, so the victim has to open the file. And per SOCRadar, the fix ships in Office updates rather than the Windows cumulative update, which means an estate that patches Windows on a tight ring schedule and Office on a looser one stays exposed after the Windows ring completes.

CISA added it to the Known Exploited Vulnerabilities catalog on 10 November, and SOCRadar puts the federal remediation deadline at 24 November. It came in a batch of six that also included CVE-2026-125350 in Chromium, two Barracuda Networks flaws, Cisco BroadWorks and Openwave's Webtop Media Transcoder.

What to install first

Volume is not priority. Elevation of privilege accounts for 48.9% of this month's CVEs and remote code execution for 27.1%, per Tenable, and most of that never touches an internet-facing surface. These are the ones that do.

• CVE-2026-119958, Windows LDAP remote code execution at CVSS 9.8, which SOCRadar describes as unauthenticated and network-reachable. If you expose LDAP anywhere it should not be, this is the month you find out.
• CVE-2026-116928, Windows Search remote code execution at CVSS 9.8, reachable through Exchange Server with no user interaction.
• CVE-2026-118207, Exchange Server remote code execution at CVSSv3 8.8, and CVE-2026-118146, Active Directory Domain Services remote code execution at the same score.
• CVE-2026-124194 in Outlook, through the Office update channel, because it is the one with confirmed exploitation.
• CVE-2026-119952, Schannel remote code execution at CVSSv3 8.1, which sits under TLS on everything.

Azure's two CVSS 9.8 entries, CVE-2026-119990 in Azure OpenAI and CVE-2026-114160 in Azure Managed Grafana, are both elevation of privilege. SOCRadar notes no customer action is required for the Azure OpenAI one.

The end-of-support list is the real bill

Rapid7 reads this month's volume as a mild let-up and points out that the number of known-exploited flaws did not rise with it, which is fair. SOCRadar puts it in context: the second-largest monthly release on record, and still smaller than October's 1,413.

The line that costs money is the support list. Rapid7 reports that from 11 November, support ended for Windows 11 version 23H2 in its Enterprise, Education and IoT editions. The same date retired .NET 8 and PowerShell 7.4 in their long-term support builds. Separately, every Exchange release other than Subscription Edition is now out of support. Anything on that list stops receiving these updates, so a clean November patch report for those estates means less than it looks like.

What IT teams should do

• Quote Microsoft's 1,094, or 1,259 with third-party advisories included, and footnote which you used. Do not reconcile vendor summaries against each other.
• Push the Outlook fix through your Office channel this week, separately from the Windows ring, and confirm it landed.
• Scan for LDAP and Windows Search exposure before the next ring, starting with anything reachable from outside or from an Exchange host.
• Pull the list of hosts on Windows 11 23H2 Enterprise, Education or IoT, .NET 8 LTS and PowerShell 7.4 LTS, and get an upgrade date on each one.
• Check whether any Exchange server is still on a version other than Subscription Edition. If so, this month's Exchange CVEs are a migration argument, not a patch.

Sources: Microsoft's November 2026 release note, Tenable, Rapid7, CrowdStrike, SOCRadar, CISA KEV additions, November 10.