Microsoft's November Patch Tuesday Addresses Record 1,407 CVEs, Including Exploited Zero-Day
Microsoft's November 2026 Patch Tuesday is set to be its largest ever, with 1,407 CVEs to be patched, including a zero-day vulnerability that has already been exploited in the wild.
Microsoft's November 2026 Patch Tuesday update is poised to break all previous records, with a staggering 1,407 unique CVEs slated for resolution. This massive release, which experienced a delay of nearly two and a half hours, underscores the persistent challenges organizations face in managing vulnerabilities, particularly those residing in older software versions.
While the sheer volume of patches is notable, the criticality of most vulnerabilities is relatively low. However, the update does address a critical zero-day vulnerability, CVE-2026-96951, which has been confirmed as actively exploited. This Windows Shell security feature bypass impacts a range of operating systems, including Windows 10, Windows 11, and Windows Server. Additionally, CVE-2026-10839, a .NET Framework security bypass vulnerability, was publicly disclosed, though it was not reported as being exploited.
A significant portion of the security news surrounding this Patch Tuesday revolves around vulnerabilities CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell by researchers. These flaws affect PHP, a widely used scripting language for web development. Exploitation in the wild was detected prior to the release of patches and has been expanding. The patching process requires a multi-step approach, including replacing the PHP runtime and restarting the web server to ensure the old, vulnerable code is removed from memory.
Beyond the regular Patch Tuesday, Microsoft issued several out-of-band and preview patches with security implications. An emergency fix for CVE-2026-111497, also known as Broccoli2Shell, Node2Shell, or HTTP2Shell, was released on October 25th. This vulnerability stems from a flaw in Brotli libraries used for processing compressed data and affects .NET versions 8 through 11. While proof-of-concept code exists, no active exploitation has been reported.
Further complicating the security landscape, Microsoft also removed seven compromised certificates from the Windows trust list on October 26th, including six eMudhra G3 roots and an AAA Certificate Services cross-sign. The preview patches also included fixes for Always On VPN connection failures introduced in September and a critical issue that rendered the Smart App Control option grayed out on Windows 11 24H2 and later versions.
The article also highlights the ongoing risk posed by obsolete software. An example cited involves an abandoned 2014 application still running on millions of devices, with update domains open for registration, creating a significant potential for widespread compromise. This underscores the critical need for organizations to maintain an accurate inventory of all running services and actively remove outdated software.
In parallel, Apple released substantial security updates for its operating systems on October 26th, addressing 183 CVEs in macOS Golden Gate 27 and backporting a fix for the exploited CVE-2026-86950 to older iOS and iPadOS versions. This vulnerability, a CoreGraphics flaw, could lead to arbitrary code execution.
Looking ahead, the November Patch Tuesday is expected to continue Microsoft's trend of high-volume releases across its product suite. Adobe is anticipated to provide updates for its Creative Cloud applications, while Google is expected to release an update for Chrome. Mozilla is also due for Firefox and Thunderbird releases, along with updates for their ESR versions.