Microsoft and Adobe Patch Tuesday, November 2026 Security Update Review | Qualys

Summary: Microsoft's November 2026 Patch Tuesday addressed 1,235 vulnerabilities, including 63 rated critical and 1,029 important, plus 142 affecting Chromium-based Microsoft Edge. Only one of the month's vulnerabilities was exploited in the wild, and Adobe released nine advisories covering 63 vulnerabilities across After Effects, Photoshop, Premiere, Audition, Experience Manager, and Dimension, four of them critical.
Why it matters: One Outlook flaw lets an unauthenticated attacker send a crafted message file that, once opened, makes Outlook connect to an attacker-controlled location without the usual external-content warning and can disclose authentication information usable to impersonate the user - and CISA added it to its Known Exploited Vulnerabilities Catalog with a patch deadline of November 24, 2026.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-105501 CVE-2026-105503 CVE-2026-105507 CVE-2026-105509 CVE-2026-105524 CVE-2026-105532 CVE-2026-105543 CVE-2026-105545 CVE-2026-105546 CVE-2026-105580 CVE-2026-108410 CVE-2026-111286 CVE-2026-111289 CVE-2026-111291 CVE-2026-112789 CVE-2026-112814 CVE-2026-112965 CVE-2026-113749 CVE-2026-113847 CVE-2026-114164 CVE-2026-114165 CVE-2026-114167 CVE-2026-118124 CVE-2026-119386 CVE-2026-119398 CVE-2026-119399 CVE-2026-119831 CVE-2026-119838 CVE-2026-119852 CVE-2026-119859 CVE-2026-119860 CVE-2026-119861 CVE-2026-119865 CVE-2026-119867 CVE-2026-119883 CVE-2026-119887 CVE-2026-119892 CVE-2026-119898 CVE-2026-119903 CVE-2026-119928 CVE-2026-119929 CVE-2026-119998 CVE-2026-120003 CVE-2026-122182 CVE-2026-122198 CVE-2026-83953 CVE-2026-95920 CVE-2026-95951 CVE-2026-96004 CVE-2026-96007 CVE-2026-96008 CVE-2026-96019 CVE-2026-96026 CVE-2026-96027 CVE-2026-96028 CVE-2026-96029 CVE-2026-96035 CVE-2026-96036 CVE-2026-96046 CVE-2026-96047 CVE-2026-96060 CVE-2026-96061 CVE-2026-96062 CVE-2026-96073 CVE-2026-96085 CVE-2026-96150 CVE-2026-96152 CVE-2026-96158
Related: November Patch Tuesday: How to Sort Through the Patches | Qualys Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026