Microsoft shipped 1094 fixes this month, 64 of them rated Critical. A further 268 entries in the same document are third-party CVEs Microsoft republishes or Edge/Chromium updates, carrying 5 Critical — counted separately here, because that total tracks Microsoft's role as a CNA rather than the size of Patch Tuesday. 2 are already under active attack and should be patched today; 0 publicly disclosed zero-days should be closed this week. Everything else fits the normal monthly cycle.
Mid-month checkpoint. First published 2026-11-10 19:14 UTC (MSRC revision 167); updated 2026-11-11 18:02 UTC against MSRC revision 192 and the current CISA KEV catalog. Sources were fetched again at update time; see Sources below.
1094
Microsoft-authored CVEs
64
rated Critical (Microsoft)
268
third-party / Chromium
5
rated Critical (everything else)
2
actively exploited
0
disclosed zero-day
As of 2026-11-11 18:02 UTC, this cycle’s MSRC document lists 1,362 CVEs
— 1,094 Microsoft-authored, plus 165 Edge/Chromium and
103 Linux/other entries that are republished third-party fixes patching through
their own vendors. That figure is a reading at a timestamp, not a fixed total for the month:
Microsoft revises this document in place, and it is currently at
revision 192 (last revised 2026-11-11 08:00 UTC).
The two Critical lines above are kept separate for the same reason — the third-party total
moves with Microsoft’s CNA scope, not with the size of Patch Tuesday.
Patch today
Confirmed in CISA KEV and flagged as exploited by Microsoft. Treat as active
incidents, not routine patching.
CVE-2026-123158ExploitedCVSS 8.1sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
in CISA KEV (added 2026-11-09); network / no-auth / no-interaction. Owner routes to the Linux / third-party (patch via OS vendor) team.
Ordered by a composite priority that weights active exploitation and disclosure
above raw CVSS. Showing the sharp end; the full ranked set of 1,362 CVEs is in the index.
The items on the sharp end, with attack profile and cross-source context.
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
↑ Corroborated — HCL BigFix field analysts independently flagged this item in their published briefing.
Sources & method
Authoritative counts and exploitation flags come from Microsoft's MSRC Security Update Guide
and CISA's Known Exploited Vulnerabilities catalog. Independent reporting and analyst
commentary corroborate and add context but do not set priority.
Ranking is a composite score that weights active exploitation and public disclosure above raw
CVSS, adjusted for network-reachable / no-authentication attack profiles and field-analyst
judgment — which is why a low-CVSS vulnerability under active attack can outrank an
unexploited 9.8.