Microsoft's November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194)
On November 10, Microsoft patched 1,093 CVEs in its November 2026 Patch Tuesday release, with 63 rated critical, 1,029 rated as important, and one rated as moderate. This update includes a patch for one zero-day, CVE-2026-124194, a spoofing flaw in Microsoft Outlook that was exploited in the wild. This month's update includes patches for 287 products and components. The products with the most CVEs patched this month are: Microsoft Office Word (65) Microsoft Office Excel (64) SQL Server (53) Windows Advanced Rasterization Platform (37) Windows Installer (36) Windows Graphics Kernel (35) Windows Kernel (28) Microsoft Office SharePoint (27) Windows DNS (22) Microsoft Office Outlook (20) Windows Print Spooler Components (20) For more information, including the full list of patched products, please visit our blog.Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
On October 13, Microsoft released its October 2026 Patch Tuesday release, which patched 1,407 CVEs with 69 rated critical, 1,337 rated as important, and one rated as low. For the second month in a row, this is the largest Patch Tuesday release ever. The previous record was September’s 964 CVEs. This update includes patches for two zero-days, both security feature bypass flaws. CVE-2026-96951 in Windows Shell was exploited in the wild, while CVE-2026-108398 in .NET Framework was publicly disclosed before a patch was available. This month’s update includes patches for 301 products and components. The products with the most CVEs patched this month are: Microsoft Office Excel (69) Role: DNS Server (52) Windows Kernel (46) Windows Installer (38) Windows Win32 Kernel Subsystem (36) Microsoft Office SharePoint (34) Microsoft Windows Search Component (29) Windows NTFS (26) .NET (25) Microsoft Office Word (22) SQL Server (22) Windows Error Reporting (22) For more information, including the full list of patched products, please visit our blog.Ivanti Endpoint Manager Mobile Zero-Days Exploited (CVE-2026-1281, CVE-2026-1340)
On January 29, Ivanti published an advisory for two zero-day vulnerabilities in Endpoint Manager Mobile (EPMM), formerly MobileIron Core: CVE Description CVSSv3 CVE-2026-1281 Ivanti Endpoint Manager Mobile Remote Code Execution Vulnerability 9.8 CVE-2026-1340 Ivanti Endpoint Manager Mobile Remote Code Execution Vulnerability 9.8 According to Ivanti, both vulnerabilities were exploited in the wild affecting “a very limited number of customers.” Due to its ongoing investigation, Ivanti did not include any indicators of compromise. Ivanti products are popular targets for attackers, and over the last several years, there have been multiple EPMM vulnerabilities exploited in the wild. For more information about these vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.Oracle E-Business Suite Zero-Day Exploited by Cl0p Ransomware Group (CVE-2025-61882)
On October 4, Oracle published a Security Alert Advisory for a zero-day in its E-Business Suite (EBS) solution: CVE Description CVSSv3 CVE-2025-61882 Oracle Concurrent Processing Remote Code Execution Vulnerability 9.8 This vulnerability was reportedly exploited in the wild by the Cl0p ransomware group. It followed earlier reports of extortion emails being sent to EBS customers by the Cl0p ransomware group. Initially, Oracle indicated that attacks used flaws in Oracle’s July 2025 CPU release. For more information about this zero-day vulnerability and associated vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.
