Microsoft fixed 1,093 flaws on November 10. Alongside an actively exploited Outlook zero-day, DNS, DHCP, LDAP and Kerberos all received CVSS 9.8 critical patches.
Microsoft closed 1,093 security flaws in its November 10, 2026 Patch Tuesday release. According to Tenable's analysis, 63 of them are rated critical. The most urgent item in the batch is CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook. Microsoft confirmed it is already being used in attacks, and CISA added it to the Known Exploited Vulnerabilities catalog on November 10, giving US federal agencies until November 24 to remediate.
The Outlook flaw is not technically complex. As Tenable describes it, an attacker only has to convince a user to open a crafted Office file. That exposes the user's NTLMv2 authentication hash, which can then be used to impersonate that user elsewhere on the corporate network. The CVSS score of 6.5 looks moderate, but confirmed in-the-wild exploitation makes that number largely academic.
The heavier risk sits on the server side
The Outlook bug took the headlines, but the more serious flaws for corporate infrastructure are in server components. Per SecurityOnline's roundup, Windows DNS (CVE-2026-88218), DHCP Server (CVE-2026-88243), LDAP (CVE-2026-119958) and Kerberos (CVE-2026-85844) all received fixes rated CVSS 9.8. SQL Server's CVE-2026-116945 carries the same score and requires no authentication at all. SharePoint Server (CVE-2026-120002) tops the list at 9.9.
That combination is not accidental. DNS, DHCP, LDAP and Kerberos sit at the centre of how a Windows domain actually works, and in most small and mid-sized companies they all run on a single server, frequently the same machine that hosts the file shares.
What this means for companies here
Across the construction offices, shipping agencies, logistics firms and clinics we support on Istanbul's Anatolian side, the picture is usually the same: one domain controller, Microsoft 365 or on-premise mail, and a handful of users connecting from outside. In that kind of setup, a single credential hash leaked through Outlook can be the starting point an attacker needs to reach the server-side flaws on the same network.
Under Turkey's personal data protection law, a data controller is obliged to maintain an appropriate level of security against unlawful access to personal data. Leaving a published, officially confirmed exploited vulnerability unpatched for months will not read well if a breach later has to be assessed against that obligation.
What Kamer Bilişim recommends
- Patch the domain servers first. The DNS, DHCP, LDAP and Kerberos flaws land directly on your domain controllers. Update those machines this week, ideally in an out-of-hours maintenance window, and take a system state backup before you start.
- Update Outlook clients in the same window, and stop NTLM from leaving the network. Push the Office and Outlook updates to every user. Then block outbound traffic on ports 445 and 139 at the firewall, since that is the usual route an NTLM hash takes on its way out.
- Stop treating patching as a one-off job. A release of 1,093 flaws cannot be tracked by hand. A maintenance agreement should cover a monthly patch calendar, a pilot group before wide rollout, a rollback plan, and regular restore tests of your backups.
If you do not know which updates your server estate is missing, mapping the current state is a few hours of work. To review your patch position together, get in touch through our contact page.
Source: Tenable, Microsoft's November 2026 Patch Tuesday Addresses 1,093 CVEs; SecurityOnline, November 2026 Patch Tuesday; SecurityWeek.
Source: Tenable