Microsoft on Tuesday released its November security updates, fixing dozens of vulnerabilities across Windows, Office and its cloud services. The Microsoft Security Response Center said at least one Windows flaw was already being exploited by attackers. The monthly release, known as Patch Tuesday, landed on the second Tuesday of the month as scheduled.

Microsoft classed the exploited bug as a privilege-escalation flaw, the type attackers use to gain full control of a machine after an initial break-in. The company's advisory said successful exploitation could give an attacker system-level privileges. Microsoft did not say who was behind the attacks or how widely the flaw had been used.

The US Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalogue the same day. Under a binding federal directive, civilian government agencies must apply the fix by the deadline CISA sets, typically within three weeks. Researchers at security firms including Tenable and Rapid7 urged corporate IT teams to prioritise the exploited flaw over the rest of the batch.

The updates also reached Windows 10 home computers enrolled in Microsoft's consumer Extended Security Updates programme. Microsoft extended that scheme in June 2026, and its documentation says coverage now runs until 12 October 2027. Enrolled devices in the European Economic Area continue to receive the updates at no cost.

Adobe and SAP published their own monthly security fixes on the same day, as is customary. Administrators therefore faced a heavy patching load ahead of the year-end change freezes common in large organisations. Microsoft's next scheduled security release falls on 8 December.