November 2026 Patch Tuesday: 149 CVEs So Far, One Critical Flaw

Microsoft's Security Update Guide shows 149 CVEs tagged to the November 2026 release as of this morning, and none of them is flagged by Microsoft as under active exploitation or publicly disclosed before a fix shipped. That single-digit-percent sliver of "actively exploited" risk is a notable change of pace after September's two attacked Windows zero-days and October's record-setting, exploited-in-the-wild month. The November count is also, for now, a small fraction of October's tally -- but that comparison comes with an important asterisk, because Microsoft's own tracker is still filling in behind the scenes, and the pattern from every recent month is that these numbers climb for weeks after release day.

This is a developing story. The breakdown below reflects exactly what Microsoft's Security Update Guide showed when we queried its public API directly on the morning of November 10, 2026 -- the same primary source Pandromeda used for its October 2026 Patch Tuesday coverage and its report on September's zero-days.

What Microsoft's tracker shows right now

Patch Tuesday landed today, November 10, 2026, and we went straight to the source: Microsoft's Security Update Guide API, filtered to releaseNumber eq '2026-Nov'. At the time of writing, that query returns 149 rows. That is the number third-party vulnerability counters will likely cite today, but it is worth being precise about what it actually contains, because it is not simply "149 Microsoft product vulnerabilities."

Of those 149 entries, 123 carry the Mariner tag -- Microsoft's internal label for CVEs in open-source packages shipped inside Azure Linux (formerly CBL-Mariner) containers. These are real vulnerabilities in real open-source components (OpenSSH, the Linux kernel, ntopng, RapidJSON, and similar packages turned up repeatedly in our pull of the full list), and Microsoft does include them in its monthly release feed because Azure Linux images need patching too. But they are not Windows, Office, or Exchange flaws, and conflating them with the headline "Patch Tuesday" count -- the way some trackers do -- inflates the number without telling you much about what is urgent on a typical Windows fleet.

Strip those out and 26 entries remain that Microsoft is attributing to its actual product line: 25 affecting Microsoft Edge (Chromium-based), and one affecting Entra Device Registration, a cloud identity service. That is the real, current "Microsoft product" count -- and notably, as of this morning, it does not yet include a single Windows, Windows Server, Office, SharePoint, SQL Server, or .NET entry.

Why the core Windows and Office bulletin is not in the numbers yet

That gap matters for how to read today's figures. On past Patch Tuesdays, the bulk of the Windows operating-system and Office bulletin has historically posted to the Security Update Guide later in the morning Pacific time, after the earlier wave of Edge and Azure Linux entries. At the time we pulled this data, nothing tagged to Windows or Office had yet appeared under the November release number. That is almost certainly a timing artifact of how Microsoft stages its own publishing pipeline on release day, not a sign that November's update is unusually light -- and it is the reason the headline 149 figure should be treated as a floor, not a ceiling.

We saw the same pattern last month: Pandromeda's own October coverage, filed on release day, cited Microsoft and tracker figures in the 1,407-to-1,415 range. Querying the same API endpoint for the October release today shows a considerably higher row count, because Chromium and Mariner entries keep accruing against a given month's release number for weeks after the fact as Google and the Azure Linux team ship their own follow-on fixes under the same monthly bucket. Expect November's 149 to grow the same way -- likely by a wide margin once the Windows and Office bulletin posts and once trailing Edge and Mariner entries keep landing.

The one Critical flaw: an Entra Device Registration bypass

The most severe entry Microsoft has published so far this cycle is CVE-2026-109469, an Entra Device Registration elevation-of-privilege vulnerability that Microsoft rates Critical with a base score of 10.0. Microsoft's own advisory describes it as an authorization bypass through a user-controlled key, letting an unauthorized attacker elevate privileges over a network with no user interaction and no special permissions required -- the kind of vector that would normally dominate a Patch Tuesday writeup.

There is a significant mitigating detail, though: this is a cloud-service CVE, and Microsoft's advisory states plainly that it has already been fully mitigated on Microsoft's end. There is no customer-facing update to deploy and nothing for Entra admins to patch; Microsoft published the CVE purely for transparency, under its Cloud Service CVE disclosure practice. Microsoft's own fields for this flaw mark it as not publicly disclosed and not exploited. The CVE.org record carries the same CWE classification -- CWE-639, authorization bypass through a user-controlled key.

In other words: it is the highest score on the board this month, but it is also the one entry on this list that genuinely requires zero action from IT teams.

Twenty-five Edge (Chromium-based) fixes, four of them scored 9.6

The next-largest cluster of genuine Microsoft entries is Edge. Twenty-five CVEs this cycle are tagged "Microsoft Edge (Chromium-based)," and the large majority were originally assigned by Google's Chrome security team and then mirrored into Microsoft's own advisory feed, since Edge ingests the underlying Chromium engine. Vulnerability types in this batch are dominated by use-after-free and memory-corruption bugs -- the perennial favorites of browser-engine security research -- plus a handful of input-validation and incorrect-reference-resolution issues.

Four of the Edge CVEs carry a 9.6 CVSS base score: CVE-2026-118309 (incorrect reference resolution, also tracked in the CVE.org record), CVE-2026-119263 (memory corruption), CVE-2026-118321 (use-after-free), and CVE-2026-119261 (improper input validation). A further batch of entries sit at 8.8, also use-after-free or memory-corruption flaws. Microsoft's advisories for the Chrome-sourced entries point users to Google's own Chrome release notes for technical detail, and the practical remediation for all of them is the same: an up-to-date Edge build, which for most organizations happens automatically unless auto-update has been disabled by policy.

The Mariner share: real CVEs, but not a Windows patching story

It is worth dwelling on the 123 Mariner-tagged entries for a moment, because they are the majority of this month's count and the reason a bare "149 CVEs" headline would be misleading without context. These are vulnerabilities in open-source components that ship inside Azure Linux container images -- things like OpenSSH, Linux kernel subsystems, RapidJSON, and network-analysis tool ntopng turned up in our pull of the full list, several scored in the 7-to-9 CVSS range. They are legitimate security issues, and Azure customers running Azure Linux containers should patch them on Microsoft's normal container-image refresh cadence.

But they are not Windows desktop or server vulnerabilities, they don't require the traditional Patch Tuesday cumulative-update cycle, and most Windows-focused IT teams can safely treat them as a separate, lower-priority workstream from the core OS and Office bulletin most admins are waiting on. Any tracker that reports "Microsoft fixed 149 vulnerabilities this Patch Tuesday" without separating this bucket out is overstating how much actually lands on a typical Windows admin's desk this month.

No confirmed active exploitation -- for now

Checking every entry in the current 149-row dataset for Microsoft's "Exploited" and "Publicly Disclosed" fields turns up nothing marked "Yes" in either column. The only two rows that carry those fields explicitly at all -- the Entra flaw and one directly-issued Microsoft entry -- are both marked "No." The remaining entries, mostly the Chrome- and Mariner-sourced CVEs, do not carry Microsoft's own exploitation-status field populated at all in this early snapshot.

A search of independent security-press coverage for "November 2026 Patch Tuesday" on the morning of release turned up no roundups yet either -- consistent with the core Windows and Office bulletin not having posted. That is a real contrast with recent months: Pandromeda reported two Windows zero-days under active attack in September, and October's record-breaking release included a Windows Shell security-feature-bypass flaw that CISA added to its Known Exploited Vulnerabilities catalog within a day of release. If November follows that pattern, it will most likely emerge once the full OS and Office bulletin posts later today -- readers should treat the absence of an "Exploited" tag right now as preliminary, not conclusive.

How November stacks up against October's record pace

Pandromeda's October 2026 Patch Tuesday coverage described that release as Microsoft's biggest ever, with trackers citing counts from roughly 1,407 to 1,415 CVEs on release day and around 70 rated Critical. Measured the same way -- a same-day snapshot of Microsoft's own release-tagged feed -- November's 149 is dramatically smaller. Even if the pending Windows and Office bulletin adds several hundred more entries once it posts, a repeat of October's scale looks unlikely based on what has shipped so far.

The more durable lesson from comparing the two months, though, is about how these numbers behave over time rather than on day one. Querying Microsoft's API for October's release number today -- a full month after that Patch Tuesday -- returns a row count several times larger than the 1,400-ish figure reported on release day, because Chromium and Mariner fixes keep accumulating against the same monthly bucket for weeks afterward. November's 149 should be read the same way: a floor that will climb, not a final tally. Readers who want the maturing picture should check back later in the month rather than treating today's number as the record for comparison purposes.

What to do now

For the entries Microsoft has published so far, the practical guidance is simple:

• Entra Device Registration (CVE-2026-109469): no action needed. Microsoft has already deployed the fix on its own infrastructure; there is nothing for admins to install.
• Microsoft Edge: confirm Edge is on auto-update (the default) or push the latest stable channel build through your management tooling. None of this month's Edge CVEs are flagged as exploited, but several are rated 8.8-9.6 and affect the browser every knowledge worker runs.
• Azure Linux (Mariner) container images: if you run Azure Linux-based containers, pull refreshed base images on your normal cadence; several of this month's OSS-package fixes score 7.0 or higher.
• Windows, Windows Server, Office, and everything else: watch for Microsoft's full bulletin to post and plan to patch on your normal Patch Tuesday cycle once it does. Given the pattern of the last several months, that is where this release's real weight -- and any exploited or publicly disclosed flaws -- is most likely to show up. We will update this count as Microsoft's Security Update Guide fills in through the day.

For background on how Microsoft's monthly release process works and why these numbers move after the fact, see Pandromeda's explainer on how Patch Tuesday works.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage