Threat Notice: November 2026 Patch Tuesday Updates

Overview 

Microsoft 

Microsoft released November 2026 Patch Tuesday updates addressing 1,235 vulnerabilities, with 142 impacting Microsoft Edge and one actively exploited vulnerability impacting Outlook. 

CVE-2026-124194 | CVSS 6.5 Moderate | Spoofing vulnerability impacting Microsoft Outlook 

  • Opening a specially crafted message file makes Outlook connect to an attacker-controlled network location without the usual external-content warning. That connection can leak the user’s NTLMv2 authentication hash, which an attacker can crack offline or use to impersonate the user. 
  • This vulnerability has been reported as actively exploited; however, details have not been released. 

Microsoft reported 22 Office remote code execution vulnerabilities this month: 12 in Excel, 4 in Word, 3 in Outlook, 2 in Office core components, and 1 in PowerPoint. 

  • Successful exploitation of these vulnerabilities could allow a threat actor to run code in the context of the user who opens the malicious content. 
  • These vulnerabilities have not been reported as actively exploited; however, they will likely be an attractive target due to the number of Microsoft Office users providing a large attack surface. 

Microsoft also patched Critical remote code execution flaws in Exchange Server (CVE-2026-118207), Microsoft Defender (CVE-2026-122194), and several network-facing Windows components, including TCP/IP, SMB Server, LDAP, and Schannel. Microsoft did not report exploitation of these vulnerabilities. 

Atlassian 

Atlassian released a fix for a critical remote code execution vulnerability in Confluence Data Center. 

CVE-2026-90436 | CVSS 9.3 Critical | Remote code execution vulnerability in Apache Axis, used by Confluence Data Center’s XML-RPC and SOAP APIs 

  • An unauthenticated attacker can execute code remotely, with no user interaction and low attack complexity. 
  • Only instances with “Remote API (XML-RPC & SOAP)” enabled are vulnerable. The setting has been off by default for new installations since Confluence 3.0, but instances where an administrator turned it on for scripts, automations, or add-ons are exposed. All Data Center versions before 10.0 are affected. Confluence 10.x and Atlassian Cloud are not. 

This vulnerability has not been reported as actively exploited at the time of writing. 

SAP 

SAP released November 2026 updates and provided patches for 35 vulnerabilities, including 4 critical vulnerabilities. 

All four of the following can be exploited without authentication or user interaction. 

CVE-2026-76964 | CVSS 10.0 Critical | Memory corruption vulnerability in the Internet Communication Manager (ICM) in SAP NetWeaver AS ABAP 

  • WebSocket control frames with invalid length fields cause a heap out-of-bounds write before any login, which can lead to code execution and full system compromise. SAP NetWeaver AS Java is not affected. 

CVE-2026-89126 | CVSS 10.0 Critical | Memory corruption vulnerability in SAP Web Dispatcher 

  • This vulnerability impacts standalone and embedded Web Dispatchers, including those in SAP HANA XS Classic and XS Advanced. The Web Dispatcher is the component that receives web requests from the internet. 

CVE-2026-120017 | CVSS 10.0 Critical | Authentication bypass in the SAML 2.0 service provider in SAP NetWeaver AS ABAP and ABAP Platform 

  • Under certain configurations, signatures on incoming SAML assertions are not checked. An attacker could log in as any user, including privileged users, on systems that use SAML single sign-on, and a full compromise could extend to connected systems. There is no workaround. 

CVE-2026-89103 | CVSS 10.0 Critical | Access control vulnerability in SAP Gateway 

  • Where secinfo and reginfo hold no explicit rules, or rely on the internal host keyword, the gateway falls back to a default list that trusts the system’s own application servers. 
  • An external attacker can be treated as one of those servers and take unauthorized actions in the application environment. The note lists no workaround. 

Google 

Google released Chrome 157 updates addressing nine vulnerabilities, including one actively exploited zero-day. 

CVE-2026-125350 | CVSS 8.8 High | Use-after-free vulnerability in Chrome’s XML component 

  • Exploitation could allow a threat actor to execute code in the browser through a malicious web page. 

This vulnerability has been reported as actively exploited; however, details of exploitation have not been released. 

What is Blackpoint doing? 

As the threat landscape shifts, Blackpoint stays ahead by building and deploying real-time detections tuned to the latest adversary tradecraft. When threats are identified, Blackpoint takes decisive action by hunting down and actioning every associated IOC across customer environments before attackers can establish a foothold or move laterally. 

Recommendations 

  • Immediate Action: Apply the November security updates across affected Microsoft, Atlassian, SAP, and Google products. 
  • Limit Outlook credential exposure. Block outbound SMB to the internet on TCP 445 at the endpoint and network perimeter so the control covers roaming users. 
  • Review firewall and endpoint logs for unexpected outbound SMB from affected workstations and investigate unusual NTLM logons involving the same users. 
  • Audit and then enforce Microsoft Defender’s attack surface reduction rule that blocks Office applications from creating child processes. 
  • Check upgraded Confluence instances and confirm whether legacy scripts or add-ons still depend on the Remote API (XML-RPC & SOAP) setting. Where the API is required, restrict access to approved integration hosts. 
  • Restrict direct access to SAP backends and Gateway services. Where the architecture supports it, allow only approved Web Dispatchers and integration hosts to reach those services. 
  • Require MFA for email, remote access, and administrative accounts. Use phishing-resistant MFA, such as passkeys or security keys, for privileged users wherever supported. 
  • Enforce least privilege. Remove standing local admin rights from standard users, require separate accounts for administrative work, and scope service accounts to the permissions their applications need. 
  • Require administrators to connect through a VPN or approved management network, and limit access to designated admin workstations. 

References 

DATE PUBLISHEDNovember 10, 2026
AUTHORBlackpoint Cyber

The Cost of Waiting

The Cost of Waiting: What Identity Attacks Cost the MSP ebook What Identity Attacks Cost the MSP Stolen credentials don't trip alarms. Once an attacker is authenticated, they look like anyone else, and most tools aren't watching what happens next. Learn what closing the identity response gap looks like: how identity attacks happen, where response slows down, and the questions to ask any ITDR vendor.
*Identity-based techniques play a role in nearly 90% of incident investigations

GET YOUR COPY