Search: CVE-2026-118146

Incorrect authorization in Active Directory Domain Services allows an authorized attacker to execute code over a network.

Microsoft's November 2026 Patch Tuesday addresses 1093 CVEs across 287 products and components, including critical, important, and moderate vulnerabilities. Notable vulnerabilities include a moderate spoofing flaw in Microsoft Outlook (CVE-2026-124194) exploited in the wild, and several critical remote code execution vulnerabilities in Windows Active Directory Domain Services, Microsoft Exchange Server, and Windows Schannel. Elevation of Privilege vulnerabilities represent nearly half of the patched issues. The update covers a wide range of Microsoft products such as Office Word, Excel, SQL Server, and Windows components.