On 10 November 2026, Microsoft published its November 2026 Security Updates. This advisory covers four of its records. CVE-2026-116928 is a Windows Search remote code execution vulnerability that Microsoft rates Critical at CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N). CVE-2026-119958 is a Windows LDAP remote code execution vulnerability that Microsoft also rates Critical at 9.8, with the same vector. CVE-2026-119952 is a Windows Schannel remote code execution vulnerability whose Microsoft CVSS 3.1 score is 8.1 High (AC:H). MSRC's severity field on that Schannel record is the vendor's Critical label, which is not the CVSS High band. CVE-2026-124194 is a Microsoft Outlook spoofing vulnerability that Microsoft rates Moderate at 6.5 (UI:R) and marks as exploited.
The scores and severity labels are Microsoft's; NVD lists all four as Awaiting Analysis and republishes Microsoft's metrics. Microsoft says none of the four was publicly disclosed and marks only the Outlook record as exploited. Of the four, only CVE-2026-124194 is in CISA's Known Exploited Vulnerabilities catalog. Apply the November 2026 Windows updates for the three RCEs, and the Microsoft 365 Apps and Office LTSC updates for Outlook, as a priority. This advisory does not cover the rest of the release.
Technical Information
CVE-2026-116928: Windows Search remote code execution
MSRC titles this issue Windows Search Remote Code Execution Vulnerability, CWE-787 (out-of-bounds write) in the Microsoft Windows Search component, and says it "allows an unauthorized attacker to execute code over a network." MSRC's exploitability assessment is Exploitation Less Likely.
Microsoft's own FAQ describes the path: an unauthenticated attacker could exploit the Windows Search component used by Microsoft Exchange Server by sending an email with a specially crafted attachment. Exchange automatically processes the attachment for indexing, so the recipient does not need to open the email or the attachment. Successful exploitation, Microsoft writes, could allow code execution with the permissions of the affected processing service. The Zero Day Initiative (ZDI) calls it "a zero-click code execution bug on a high-value target"; that characterization is ZDI's. The MSRC product tree lists Windows SKUs, not a separate Exchange Server product line.
CVE-2026-119958: Windows LDAP remote code execution
MSRC titles this issue Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability, also CWE-787, which Microsoft rates Critical at 9.8. The MSRC FAQ says an unauthenticated attacker who successfully exploited it could gain code execution through a specially crafted set of LDAP calls, running code in the context of the LDAP service. MSRC's exploitability assessment is Exploitation Less Likely. ZDI writes that, because code runs in the LDAP service context, the issue "could be quite destructive, especially on Domain Controllers." That language is ZDI's, not Microsoft's.
CVE-2026-119952: Windows Schannel remote code execution
MSRC titles this issue Windows Schannel Remote Code Execution Vulnerability, CWE-208 (observable timing discrepancy). The Microsoft CVSS 3.1 base score is 8.1 High because attack complexity is high (AC:H). Microsoft's own severity rating for this Schannel record is Critical; that is the vendor label, not the CVSS band. The MSRC FAQ says an unauthenticated attacker could send a specially crafted packet to an affected service over the network, with no authentication or user interaction required, and that successful exploitation could allow code execution on the target system. Microsoft adds that an attacker would need specific conditions, such as particular protocol settings or configurations, which "reduces the likelihood of widespread or opportunistic exploitation." Unlike the two 9.8 RCEs, MSRC's exploitability assessment here is Exploitation More Likely.
CVE-2026-124194: Microsoft Outlook spoofing, marked exploited
MSRC titles this issue Microsoft Outlook Spoofing Vulnerability and rates it Moderate, 6.5, with user interaction required. The weakness is CWE-356, product UI does not warn the user of unsafe actions. Microsoft marks it exploited, with Exploitation Detected.
Microsoft's FAQ says an unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without the usual external-content warning. Microsoft says this discloses the user's NTLMv2 hash, which the attacker could use to authenticate as the user. Microsoft answers "Is the Preview Pane an attack vector for this vulnerability?" with "No, the Preview Pane is not an attack vector."
Affected Product Versions
Per the MSRC CVRF product tree, the three RCEs share the same Windows SKU set: Windows 10 (1607, 1809, 21H2, 22H2; 32-bit, x64, and ARM64 where listed); Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2; x64 and ARM64); and Windows Server 2016, 2019, 2022, and 2025, including Server Core where listed. The fixes are November 2026 Windows security updates, including cumulative updates and hotpatches (KB5131077, KB5131080, KB5131085, KB5131087, KB5131090, KB5131096, KB5131291, KB5132043, KB5132059, and KB5132061). Confirm the KB for each build in the MSRC update guide; some packages require a restart and others do not.
CVE-2026-124194 is listed for Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 (32-bit and 64-bit). The CVRF points to Microsoft's Microsoft 365 Apps security updates page rather than a Windows cumulative update.
Exploitation Status
Microsoft marks CVE-2026-116928, CVE-2026-119958, and CVE-2026-119952 as not exploited and not publicly disclosed, and this advisory does not claim otherwise. It marks CVE-2026-124194 as exploited and not publicly disclosed. CISA added only CVE-2026-124194 of these four to KEV on 10 November 2026 (catalogVersion 2026.11.10, checked 10 November 2026 at 22:30 Asia/Jerusalem UTC+2), with a due date of 24 November 2026 and known ransomware campaign use listed as Unknown. Microsoft's advisory does not describe the observed attacks.
Workaround and Mitigation
The MSRC records for these four CVEs list vendor fixes and release notes, but no workaround, and this advisory does not invent one. The official mitigation is to apply the November 2026 Windows security updates that MSRC lists for CVE-2026-116928, CVE-2026-119958, and CVE-2026-119952, and the Microsoft 365 Apps or Office LTSC security updates for CVE-2026-124194. Keep evidence of the installed OS build or Office/Microsoft 365 Apps version after updating.
Indicators of Compromise
The MSRC, NVD, and CISA records reviewed publish no domains, IP addresses, file hashes, or detection signatures for these CVEs, and this advisory does not invent any. Unexpected Outlook connections to unknown locations, or NTLM events after a user opens a message file, may be leads for CVE-2026-124194, not confirmed signatures.
What to Ask Your Suppliers Today
Ask vendors who run Microsoft Exchange, domain controllers or other systems exposing LDAP, or Schannel-facing Windows services whether those hosts run a Windows build affected by CVE-2026-116928, CVE-2026-119958, or CVE-2026-119952. Request a named owner, a committed date to apply the November 2026 Windows updates, and post-update build evidence. For Microsoft 365 Apps and Office LTSC 2021 or 2024, ask whether the November 2026 Office security updates for CVE-2026-124194 have been applied, and on what date.
If a supplier cannot patch immediately, ask what compensating controls they rely on; Microsoft publishes no workaround, so none should be treated as a fix. For the Outlook NTLM-hash issue, ask whether they block outbound SMB and NTLM from user workstations while updates are pending. That is a compensating-control question, not a Microsoft-published workaround. Track incomplete answers to closure.
Need help working through Windows, Exchange, and Outlook suppliers exposed to these November 2026 updates? Our team can help you prioritize them. Talk to an expert
Sources
- MSRC CVE-2026-116928 — Critical 9.8; exploited No; publicly disclosed No; Exploitation Less Likely; Exchange-indexing FAQ.
- MSRC CVE-2026-119958 — Critical 9.8; exploited No; publicly disclosed No; Exploitation Less Likely; LDAP-service FAQ.
- MSRC CVE-2026-119952 — Microsoft CVSS 3.1 8.1 High (
AC:H); exploited No; publicly disclosed No; Exploitation More Likely. MSRC's severity field on this Schannel record is the vendor Critical label, not the CVSS High band. - MSRC CVE-2026-124194 — Moderate 6.5; exploited Yes; publicly disclosed No; Preview Pane is not an attack vector; NTLMv2 FAQ.
- MSRC CVRF 2026-Nov — "November 2026 Security Updates"; product tree, KBs, and threat flags. Checked 10 November 2026 at 22:30 Asia/Jerusalem UTC+2.
- NVD: CVE-2026-116928, CVE-2026-119958, CVE-2026-119952, CVE-2026-124194 — Awaiting Analysis; Microsoft metrics republished.
- CISA KEV catalog JSON — catalogVersion 2026.11.10; CVE-2026-124194 added 2026-11-10, due 2026-11-24; the three RCEs not listed. Checked 10 November 2026 at 22:30 Asia/Jerusalem UTC+2.
- Zero Day Initiative, 10 November 2026 — zero-click and LDAP Domain Controller wording attributed to ZDI in the body.
- SecurityWeek, 10 November 2026 — reports Microsoft's Outlook FAQ details.
