What's happened since October Patch Tuesday

The weeks leading up to November Patch Tuesday gave defenders three clear tests of how fast they can move. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was exploited before PHP shipped fixes and reached CISA’s Known Exploited Vulnerabilities (KEV) catalog on October 26. Node2Shell (CVE-2026-111497) followed on October 27. Then SSHole (CVE-2026-123158), an OpenSSH authentication bypass that affects only specific configurations, was exploited within days of disclosure and added to KEV on November 9. Each had a different exposure profile, and the response had to start with the same question: are we running it, is it reachable, and is anyone exploiting it?

The KEV data shows why that question matters now. From April 1 through November 9, CISA added 217 CVEs to KEV, up 52% from the same window in 2025, and the 288 additions so far in 2026 already exceed all of last year’s 245. But 288 is a small number against the roughly 95,000 CVEs disclosed this year, which is why exploitation evidence is such a useful filter. Roughly four in ten of this year’s exploited vulnerabilities sit in operating systems, endpoint software, browsers, and server platforms, which a continuous patch strategy can close quickly. The rest calls for exposure management alongside patching, especially the 44% that sit in edge devices and IT management or remote access tools, the internet-facing systems that hold privileged access. Teams that can quickly identify those assets, confirm exposure and act on confirmed exploitation can focus on the small slice of vulnerabilities attackers are actively using, while the rest stays on the normal patch cadence.

Microsoft

Microsoft’s November 2026 Patch Tuesday addresses 1,093 CVEs: 63 Critical, 1,029 Important and 1 Moderate. One vulnerability is actively exploited, CVE-2026-124194, an Outlook spoofing flaw rated Moderate, and none are publicly disclosed. Elevation of privilege (535) and remote code execution (296) make up most of the release. Of the 63 Critical CVEs, 48 are remote code execution and 15 are elevation of privilege, concentrated in Excel (12), Hyper-V (8) and Message Queuing (5), with additional Critical RCEs in Exchange Server, IIS, Schannel, TCP/IP, SMB and Defender. Word, Excel, and SQL Server carry the most CVEs overall, with 65, 64 and 53.

One vulnerability is confirmed exploited:

Microsoft resolved a Spoofing vulnerability in Microsoft Outlook (CVE-2026-124194), which could allow an unauthorized attacker to perform spoofing over a network. The vulnerability is rated Moderate by Microsoft and has a CVSS score of 6.5, but is confirmed to be exploited in the wild. An attacker could send a specially crafted message file and convince a user to open it causing a connection to an attacker-controlled network location without the usual external-content warnings, potentially disclosing authentication information that could be used to impersonate the user. The vulnerability affects Microsoft 365 Apps for Enterprise and LTSC 2024 and 2021 editions of Microsoft Office. A risk-based prioritization approach warrants treating this vulnerability as Critical and resolving it as a priority this month.

Third-Party Updates

Adobe

Adobe released nine security bulletins on November 10 that resolve 110 CVEs: 22 Critical, 48 High, 37 Medium, and three Low. None are Priority 1, and Adobe is not aware of any exploits in the wild. The two Priority 2 updates carry the most risk. Connect (APSB26-191) has the largest count at 24 CVEs, 18 of them Critical and six rated CVSS 10.0. The vulnerabilities span SSRF, path traversal and SQL injection, and affect Windows on-prem versions 12.12 and earlier. Experience Manager (APSB26-189) fixes 14 CVEs, including four Critical code execution flaws at CVSS 9.9. The remaining seven bulletins are Priority 3 creative and developer tools, mostly High-severity memory corruption and code execution issues: After Effects (17 CVEs), Photoshop (13), Content Credentials SDK (13), Premiere (11), Audition (11), Media Encoder (6) and Dimension (1, macOS only). Photoshop 2025 will not receive an update, so those users need to move to Photoshop 2026 or 2027, and none of these updates apply to Adobe Commerce or ColdFusion this month.

Google

Google Chrome 157.0.8103.50 released on Monday, November 9 resolving nine CVEs including CVE-2026-125350, which is being actively exploited in the wild. This marks Chrome’s eighth zero-day exploit of 2026. Chromium-based browsers such as Edge will need the fix as well, and users should relaunch after updating for the patch to take effect. This follows Chrome 157’s November 3 release, which fixed 213 vulnerabilities, seven of them Critical. Separately, Google’s November Android bulletin fixed 216 vulnerabilities, 23 of them Critical, with none marked as exploited. The target is patch level is 2026-11-05 or later.

Mozilla

Mozilla’s November 10 release is large, with no vulnerabilities reported as exploited. Firefox 160 resolves 99 CVEs (57 High, 24 Moderate, 18 Low). Firefox ESR 153.7 resolves 81 (51 High, 21 Moderate, 9 Low), and ESR 115.45 resolves 28, all High. Many of the High-rated issues are use-after-free and memory boundary flaws across graphics, DOM, layout, and JavaScript components, including a number of sandbox escapes such as CVE-2026-124907, a use-after-free in WebGL that allows privilege escalation and sandbox escape. About a quarter of the Firefox 160 fixes are credited to OpenAI researchers, continuing a trend from Firefox 159. Mozilla’s own ratings are lower than some third-party trackers show. For example, CVE-2026-124941 and CVE-2026-124950 are rated Low, so use Mozilla’s ratings in published numbers.

Ivanti November 2026 Security Update
Ivanti’s November 2026 security update addresses 13 unique CVEs across five products. Endpoint Manager (EPM) resolves two, including a critical unauthenticated SQL injection in the Core (CVE-2026-121653, CVSS 9.8) fixed in 2024 SU8. Endpoint Manager Mobile (EPMM) resolves six, one high and five medium, fixed in 12.11.0.0, 12.10.0.1 and 12.9.0.3. Ivanti Sentry resolves four, including CVE-2026-105425, an admin-authenticated OS command injection that it shares with EPMM. Cloud Services Application (CSA) resolves one, CVE-2026-121683, and User Workspace Manager resolves one, CVE-2026-105813. Ivanti is not aware of any customers being exploited by the EPMM or EPM vulnerabilities at the time of disclosure.

November update to-do list

  1. Deploy Google Chrome and Microsoft Edge ASAP to resolve CVE-2026-125350 which is actively being exploited. This will also catch systems up that may not have updated to the November 3rd update which resolved 213 CVEs.
  2. Microsoft Office 365 App for Enterprise and Microsoft LTSC 2024 and 2021 editions resolve CVE-2026-124194 which is actively exploited. Deploying these office updates urgently is recommended.