Threat intelligence, Threat Research
Microsoft Security Bulletin Coverage for November 2026
Overview
Microsoft’s November 2026 Patch Tuesday has 1080 vulnerabilities, of which 529 are Elevation of Privilege. SonicWall Capture Labs threat research team has analyzed and addressed Microsoft’s security advisories for the month of November 2026 and has produced coverage for 22 of the reported vulnerabilities.
Vulnerabilities with Detections
CVE | CVE Title | Signature |
| CVE-2026-105524 | Windows Management Instrumentation Elevation of Privilege Vulnerability | ASPY 7393 Exploit-exe exe.MP_684 |
| CVE-2026-109473 | Windows Kernel Elevation of Privilege Vulnerability | ASPY 7378 Exploit-exe exe.MP_671 |
| CVE-2026-112798 | Windows NetBIOS Elevation of Privilege Vulnerability | ASPY 7398 Exploit-exe exe.MP_689 |
| CVE-2026-112811 | Windows Print Spooler Components Elevation of Privilege Vulnerability | ASPY 7394 Exploit-exe exe.MP_685 |
| CVE-2026-118207 | Microsoft Exchange Server Remote Code Execution Vulnerability | IPS 22624 Microsoft Exchange Server Remote Code Execution (CVE-2026-118207) |
| CVE-2026-119389 | Windows Storage Elevation of Privilege Vulnerability | ASPY 7388 Exploit-exe exe.MP_680 |
| CVE-2026-119886 | Windows Telephony Service Elevation of Privilege Vulnerability | ASPY 7389 Malformed-ps1 ps1.MP_5 |
| CVE-2026-119992 | Windows HTTP.sys Elevation of Privilege Vulnerability | IPS 22625 Windows HTTP.sys Elevation of Privilege (CVE-2026-119992) |
| CVE-2026-83563 | Winlogon Elevation of Privilege Vulnerability | ASPY 7379 Exploit-exe exe.MP_672 |
| CVE-2026-88230 | Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability | ASPY 7395 Exploit-exe exe.MP_686 |
| CVE-2026-88242 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | ASPY 7380 Exploit-exe exe.MP_673 |
| CVE-2026-94514 | Windows Kernel Elevation of Privilege Vulnerability | ASPY 7381 Exploit-exe exe.MP_674 |
| CVE-2026-95874 | Xbox Gaming Services Elevation of Privilege Vulnerability | ASPY 7383 Exploit-exe exe.MP_676 |
| CVE-2026-95920 | Windows Management Instrumentation Elevation of Privilege Vulnerability | ASPY 7396 Exploit-exe exe.MP_687 |
| CVE-2026-95935 | Windows Graphics Kernel Elevation of Privilege Vulnerability | ASPY 7385 Exploit-exe exe.MP_677 |
| CVE-2026-95963 | Data Sharing Service Client Elevation of Privilege Vulnerability | ASPY 7386 Exploit-exe exe.MP_678 |
| CVE-2026-95983 | Windows Graphics Kernel Elevation of Privilege Vulnerability | ASPY 7390 Exploit-exe exe.MP_681 |
| CVE-2026-95988 | Windows Kernel Elevation of Privilege Vulnerability | ASPY 7391 Exploit-exe exe.MP_682 |
| CVE-2026-95989 | vhdmp.sys Elevation of Privilege Vulnerability | ASPY 7392 Exploit-exe exe.MP_683 |
| CVE-2026-96077 | Windows TCP/IP Denial of Service Vulnerability | IPS 4638 Windows TCP/IP DoS (CVE-2026-96077) |
| CVE-2026-96126 | Windows Graphics Kernel Elevation of Privilege Vulnerability | ASPY 742 Exploit-exe exe.MP_679 |
| CVE-2026-97013 | Windows Shell Elevation of Privilege Vulnerability | ASPY 7397 Exploit-exe exe.MP_688 |
Release Breakdown
The vulnerabilities can be classified into the following categories:
For November there are 1019 important and 59 critical vulnerabilities.
Microsoft tracks vulnerabilities that are being actively exploited at the time of discovery and those that have been disclosed publicly before the patch Tuesday release for each month. The above chart displays these metrics as seen each month.
Share This Article
An Article By
An Article By
Security News
Security News
The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.
