November Patch Tuesday: How to Sort Through the Patches | Qualys

Summary: Qualys reports that Microsoft addressed 63 CVEs in November 2025 but 1,252 in November 2026, nearly 20 times higher, with an average of roughly 650 CVEs per month since April 2026 versus about 74 between November 2025 and March 2026. As of 3 p.m. MT on November 11, about 35% of the month's patches carried a Low reliability rating in Qualys's Patch Reliability Assessment, including KB5131085 for Windows 10/Windows Server 2019, which addresses CVE-2026-119892 and 574 other CVEs and was reported by the community to break Exchange.
Key Takeaway: A team whose manual patching capacity did not grow twentyfold in a year now faces roughly 650 CVEs a month, and more than a third of this month's patches carry a Low reliability rating that says test before broad rollout.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-119892
Related: Microsoft and Adobe Patch Tuesday, November 2026 Security Update Review | Qualys Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026