Microsoft’s November patch release fixes 1,093 vulnerabilities in Windows operating systems and supported software, including 63 critical flaws and one active Outlook spoofing bug. The update comes during a week of security releases from Apple, Google, Mozilla and Adobe, while Microsoft says its year-to-date patch total has passed 5,100.
Windows updates and the active Outlook flaw
Microsoft’s latest bundle addresses 1,093 security issues across its products. It includes 63 critical vulnerabilities, and nearly half of those critical bugs are remote code execution flaws that can let an attacker seize control of a Windows system with little or no user help. In total, 535 of the fixed flaws would let an attacker raise privileges on a vulnerable device. Microsoft also says one flaw is already being actively exploited: CVE-2026-124194, a spoofing bug in Outlook that affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.
The scale of Microsoft’s patching this year
The company has now shipped more than 5,100 security patches this year. A year ago, Microsoft was averaging around 100 patches per month, and last month it pushed more than 1,400 fixes. Microsoft credits advances in artificial intelligence for helping find and fix such a large volume of security bugs in recent months.
What Apple fixed this week
Apple released out-of-cycle security updates on Monday to fix at least nine vulnerabilities in iOS, iPadOS, macOS, watchOS and visionOS. The release reportedly includes an iMessage flaw that could let a remote attacker join a group chat and receive its messages, along with another iMessage flaw that could let someone added to a group read messages sent before they joined. Lee Neely, an instructor at the SANS Institute, said Apple backported the fix to iOS 18.
Neely said he pays attention when Apple fixes more than two versions. He also said people should get to version 27.2.1 of Apple’s operating systems and push users who still rely on devices that cannot run the current version. He said the best plan often includes setting an upgrade date for old hardware, checking every Apple device, and not assuming the fixes arrived automatically.
Google, Mozilla and Adobe updates
Google released Chrome version 157.0.8103.50, which fixes nine security holes, including CVE-2026-125350. Google says that flaw is the sixth zero-day vulnerability this year for Chrome, and it is also being patched in Chromium-based browsers such as Edge. Chrome’s latest version follows the November 3 release that fixed 213 vulnerabilities. Mozilla released Firefox 160 today, and it resolves almost 100 CVEs, about half of them high severity. Adobe released patches for at least 110 vulnerabilities across several products, with nearly half rated high severity, and Adobe said there is no evidence that any of the issues fixed this month are being actively exploited.
Patch pressure and exploited vulnerabilities
Chris Goettl, vice president of product management at Ivanti, said large enterprises can feel overwhelmed by the volume and severity of Microsoft’s patches. He said about 95,000 vulnerabilities have been assigned CVEs this year across all vendors, but only 217 have been added so far this year to the Known Exploited Vulnerabilities list maintained by the U.S. Cybersecurity and Infrastructure Security Agency. He also said roughly four in ten of this year’s exploited vulnerabilities are in operating systems, endpoint software, browsers and server platforms, while 44% are in edge devices and IT management or remote access tools, including internet-facing systems with privileged access. His advice was to identify those assets quickly, confirm exposure and act on confirmed exploitation, while the rest stays on the normal patch cadence.
Back up data before updating
Any important data should be backed up before applying operating system updates if it has not been backed up recently. If problems come up while applying Microsoft’s update bundle, readers are invited to leave a comment.
Licensed under CC BY-ND 4.0 International