November 2026 Patch Tuesday: What Small Businesses Should Patch Now
What did Microsoft fix in the November 2026 Patch Tuesday?
Microsoft’s November 2026 Patch Tuesday, released on November 10, 2026, fixes 1093 vulnerabilities in its own products, 63 of them rated critical, and 1 that attackers were already exploiting before the fix. Every Windows PC and Microsoft Office install should get this month’s updates within a few days, and any already-exploited flaw should be treated as urgent.
Patch Tuesday is the second Tuesday of each month, when Microsoft releases its scheduled security updates. Attackers study the fixes to work out the holes they close, so the days after release are when unpatched computers are most at risk. Microsoft’s full list is in its Security Update Guide.
Which vulnerabilities were already being exploited?
These are the ones to care about first. Microsoft confirmed attacks using them before the update was available:
- Microsoft Outlook Spoofing Vulnerability (CVE-2026-124194)
Which Microsoft products are affected this month?
The most-patched components this month were Microsoft Office Word (65), Microsoft Office Excel (64), SQL Server (53), Windows Advanced Rasterization Platform (37), Windows Installer (36), Windows Graphics Kernel (35). Office users should note fixes in Microsoft Office Word, Microsoft Office Excel, Microsoft Office SharePoint, Microsoft Office Outlook; a malicious document is still one of the most common ways attacks start, so Office updates matter as much as Windows ones.
For most offices that means three things: Windows Update on every PC, Microsoft 365 or Office updates (they usually install themselves, but check that they have), and any on-premises server such as SQL Server or a file server.
What did CISA add to its exploited vulnerabilities list this week?
CISA’s Known Exploited Vulnerabilities catalog lists flaws with confirmed attacks in the wild. These are the additions from the past seven days in products a small business is likely to run:
| Product | Flaw | Added |
|---|---|---|
| WordPress WordPress Core | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (CVE-2026-119977). | 2026-11-03 |
| Apple Multiple Products | Apple Multiple Products Improper Authentication Vulnerability (CVE-2024-27834). | 2026-11-04 |
| SonicWall SonicOS SSLVPN | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability (CVE-2026-19868). | 2026-11-06 |
| Cisco BroadWorks | Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability (CVE-2026-20320). | 2026-11-10 |
| Google Chromium | Google Chromium Use-After-Free Vulnerability (CVE-2026-125350). | 2026-11-10 |
| Microsoft Office | Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability (CVE-2026-124194). | 2026-11-10 |
Does this affect my business?
- Firewalls and VPN appliances: If your office firewall or remote-access VPN is one of these brands, it is the most urgent item here: these devices face the internet, and attackers scan for unpatched ones within days. Check the firmware version, not just whether the device is working.
- Windows and Microsoft 365: Every Windows PC needs this month’s updates. Check that they actually installed: a PC that has not restarted in weeks usually has not finished updating.
- Web browsers: Browsers update themselves, but only when they restart. Have staff close and reopen Chrome, Edge or Firefox today.
- iPhones, iPads and Macs: Update company and personal Apple devices that touch work email or files: Settings, General, Software Update.
- Website, online store and file-transfer software: If you or your web host run this software, ask them to confirm it is patched.
Which Microsoft deadlines are coming up?
- OneDrive and SharePoint sharing, mid-October to the end of November. Outside people opening older links you shared with them will get “access denied” until they have a guest account. The one-step fix.
- Copier scan to email, end of December. Microsoft 365 switches off the password sign-in most copiers use to send scans. How to check your copier and four fixes.
What should a small business do this week?
- Confirm updates installed on every PC, including laptops that are rarely in the office.
- Restart computers and browsers so pending updates finish.
- Check your firewall and VPN firmware against the vendor’s latest version.
- Make sure multi-factor authentication is on for email and remote access, so a single exploited flaw or stolen password is not enough.
- Know when your backup was last restored from, not just whether it ran.
For the businesses we manage, this is handled centrally: updates are pushed and verified overnight. More on how that works: managed endpoint protection and patching, network security.
Catch up with the previous alert, Security Alert, Week of November 3, 2026: Actively Exploited Flaws to Patch, or all weekly security alerts.
Want This Handled for You?
iTech Plus provides managed IT and cybersecurity for small businesses and medical practices across Polk County, including Lakeland, Winter Haven, Davenport and Haines City. If you are not sure your computers and firewall are patched, we offer a free IT assessment with a written report. Call (321) 221-7117 or email info@itechplus.co.
