{"resourceId":"crowdstrike-november-2026-patch-tuesday-analysis-2026-11-10","versions":[{"version":"external-6f3369aed15b4a4479c006430f260f074fa224717c077bd09fc2362b60f755d8","resource":{"id":"crowdstrike-november-2026-patch-tuesday-analysis-2026-11-10","title":"CrowdStrike's November 2026 Patch Tuesday analysis: an exploited Outlook zero-day and zero-click flaws in Exchange search indexing and Windows LDAP","organization":"CrowdStrike Falcon Exposure Management team","sector":"Vulnerability management (cross-sector)","geography":"Global","publishedAt":"November 10, 2026","publicationDate":"2026-11-10","eventDate":"2026-11-10","sourceName":"CrowdStrike blog","sourceLabel":"Vendor analysis","sourceUrl":"https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-november-2026/","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["infrastructure","operating-model","data-security"],"finding":"CrowdStrike counts 1,252 Microsoft fixes this month, including one exploited zero-day and 68 Critical vulnerabilities, with 745 Windows patches and 658 for Extended Security Updates (ESU). It highlights the exploited Outlook spoofing flaw CVE-2026-124194 that leaks NTLMv2 hashes when a crafted file is opened, CVE-2026-116928 in Windows Search that Exchange triggers when indexing an emailed attachment with no user action, CVE-2026-119958 unauthenticated remote code execution in Windows LDAP on domain controllers, eight preview-pane Office flaws and 14 unauthenticated network-reachable remote code execution flaws in legacy services such as MSMQ. Independent outlets report a lower total of about 1,093 to 1,094; CrowdStrike does not explain its counting.","sledRelevance":"Government and school networks rely on Active Directory and Outlook, many still run on-premises Exchange, and older Windows fleets on ESU are common in agencies and districts. Zero-click paths through mail servers and domain controllers are the highest-impact items for small public IT teams this month.","evidence":"Opened the full CrowdStrike blog (Nov 10). CVE details match Microsoft's advisories as quoted by The Register; the headline total differs from Krebs and The Register, likely because of counting choices that CrowdStrike does not state.","architectureImplications":"On-premises Exchange and domain controllers are the priority; organizations on Exchange Online still need to patch Windows Search where Exchange servers remain.","governanceImplications":"Monthly volumes above 1,000 fixes make CVSS-only prioritization impractical; risk-based ordering by exposure and exploitation needs documented approval.","securityPrivacyImplications":"NTLM hash disclosure and domain controller compromise put identity, and therefore resident and student records, at risk.","caveats":"Vendor analysis; total count differs from independent reporting without explanation; no exploitation data beyond Microsoft's single exploited flag.","streamIds":["crowdstrike"],"roles":{"sales":"The framing point is prioritization under record volume. Ask agencies and districts whether they still run on-premises Exchange and how fast they patch domain controllers. Exposure management and endpoint detection can help order the work, as interpretation. Use the independent 1,093 to 1,094 count alongside CrowdStrike's 1,252 rather than quoting one number as fact.","engineering":"The framing point is zero-click paths. Identify on-premises Exchange servers and domain controllers, apply the Windows Search and LDAP fixes first, and confirm whether Outlook clients can be protected from the exploited NTLM leak with outbound SMB/NTLM restrictions. Check ESU coverage on legacy Windows hosts and verify sensors report patch state.","delivery":"The framing point is a documented priority order. Propose a short ranked list for this cycle, starting with exploited and zero-click items, with named owners and target dates. Measure patch coverage on domain controllers and mail servers at seven and fourteen days, and record exceptions for systems that cannot be patched."},"roleDetails":{"sales":{"customerProblem":"Record patch volumes overwhelm small public IT teams that must decide what to fix first.","stakeholders":["IT director or CIO","Systems administrators","Identity or Active Directory owner","Messaging administrator"],"discoveryQuestions":["Do you still run on-premises Exchange?","How long does it take to patch all domain controllers?","How many devices depend on Extended Security Updates?"],"valueHypothesis":"Exposure-based prioritization may shorten time to patch the highest-impact systems; no measured SLED results are offered.","potentialEngagement":"A one-cycle patch prioritization and exposure review focused on mail servers and domain controllers.","unsupportedClaims":["That 1,252 is the definitive count","That any product removes the need to patch","Exploitation of the zero-click flaws in the wild"]},"engineering":{"fit":"Microsoft-centric agencies, campuses and districts, especially with on-premises Exchange or ESU fleets.","architectureIntegration":"Use vulnerability management and endpoint telemetry to rank fixes by exposure and exploitation, feeding existing patch tooling.","prerequisites":["Inventory of Exchange servers and domain controllers","Patch deployment tooling","Device inventory with ESU status"],"constraints":["Change windows during school terms or elections","Legacy hardware on ESU","Testing time for domain controller patches"],"security":"Prioritize the exploited Outlook NTLM leak and zero-click Exchange and LDAP flaws; restrict outbound NTLM where possible.","proofOfValue":["Domain controllers patched within an agreed window","Outbound NTLM to external hosts blocked in test","Patch status reported for all ESU devices"]},"delivery":{"work":"Ranked patch plan for the cycle with tracking and exceptions.","dependencies":["Change approval","Patch tooling","Asset inventory"],"ownership":"Infrastructure operations under the CISO.","skillsAdoption":"Staff trained on risk-based prioritization over severity-only lists.","governanceCheckpoints":["Priority list approved","Seven-day coverage review","Exceptions signed off"],"acceptanceCriteria":["Proposed: all domain controllers and Exchange servers patched within 14 days","Proposed: exceptions documented with compensating controls"],"risks":["Patch-induced outages on domain controllers","Missed legacy servers","Confusion from differing CVE counts"]}},"retrievedAt":"2026-11-11T04:03:43Z","enrichedAt":"2026-11-11T04:06:40Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Patch volume at this scale strains small teams and argues for automation and shared services.","procurementImplications":"ESU-dependent fleets carry continued patch burden and cost; this is a reason to revisit hardware refresh timing.","operatingModelImplications":"Patching becomes a continuous triage function rather than a monthly event.","sourceVerification":{"openedUrl":"https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-november-2026/","referenceExcerpt":"Microsoft addressed 1,252 vulnerabilities in its November 2026 security update release, including one exploited zero-day vulnerability and 68 Critical vulnerabilities.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}