Microsoft Addresses Nearly 1,100 Security Vulnerabilities in Latest Update

11 November 2026 3 min read هدهد تك | Hudhud Tech

Microsoft released updates to address nearly 1,100 security vulnerabilities in its Windows operating systems and supported software on November 10. This month’s Patch Tuesday includes fixes for 63 critical flaws, one of which is a zero-day vulnerability in Microsoft Outlook. The updates coincide with significant security patches from other software companies, including Adobe, Apple, Google, and Mozilla.

The November patch release tackles 1,093 vulnerabilities, with 63 classified as “critical.” These critical flaws can be exploited to take control of a Windows system with minimal user interaction. Almost half of these critical vulnerabilities are related to remote code execution. Additionally, 535 of the flaws allow attackers to elevate their privileges on vulnerable devices.

This update brings the total number of security patches Microsoft has issued this year to over 5,100, a significant increase compared to last year’s average of around 100 patches per month. Microsoft attributes this surge to advancements in artificial intelligence that have aided in identifying and resolving security issues.

Among the vulnerabilities, CVE-2026-124194, a spoofing bug in Outlook, is reportedly being actively exploited. This flaw affects Microsoft 365 Apps for Enterprise and various editions of Microsoft Office.

In addition to Microsoft, several other major software vendors have released security updates this week. Apple issued out-of-cycle updates to fix at least nine vulnerabilities across iOS/iPadOS, macOS, watchOS, and visionOS. Among the vulnerabilities addressed is an iMessage flaw that could allow a remote attacker to join a group chat and access its messages.

Lee Neely, an instructor at the SANS Institute, noted that Apple has backported the fix to iOS 18, emphasizing the importance of updating devices. He stated, “You really need to get to version 27.2.1 of their OSes and push folks who are holding onto devices which cannot run the current version.”

Google also released Chrome version 157.0.8103.50, which addresses nine security vulnerabilities, including CVE-2026-125350, marking the sixth zero-day vulnerability for Chrome this year. This update follows a previous release on November 3 that fixed 213 vulnerabilities. A new version of Mozilla Firefox released today, Firefox 160, resolves nearly 100 CVEs, with about half classified as high severity.

Adobe has also issued patches for at least 110 vulnerabilities across various products, with nearly half rated as high severity. Adobe stated that there is currently no evidence of active exploitation of the vulnerabilities it addressed this month.

Chris Goettl, vice president of product management at Ivanti, remarked that the volume and criticality of patches from Microsoft can overwhelm security teams at large enterprises. He noted that while approximately 95,000 vulnerabilities have been assigned CVEs this year, only 217 have been added to the Known Exploited Vulnerabilities (KEV) list maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

Goettl emphasized that a continuous patch strategy can quickly address vulnerabilities in operating systems, endpoint software, browsers, and server platforms. He advised that teams should focus on identifying assets that are exposed and confirm any exploitation to prioritize their patching efforts.

Users are reminded to back up important data before applying operating system updates. If any issues arise while applying this month’s updates from Microsoft, users are encouraged to report them.