Microsoft November 2026 Patch Tuesday: seven of the unauthenticated network flaws rated CVSS 9.8, in domain infrastructure and server roles, among them a Kerberos relay to a domain controller (CVE-2026-85844) and zero-click code execution through Exchange attachment indexing (CVE-2026-116928); none exploited or disclosed
Patch Tuesday: Kerberos relay to a DC and Exchange zero-click RCE lead the 9.8 server rows; none exploited
Defender actions
- Install the November 2026 cumulative update on every domain controller and every Exchange server first, then on DNS, DHCP and SQL Server hosts, because the Kerberos relay ends in SYSTEM on a domain controller and the Exchange flaw runs code from an inbound mail attachment that nobody has to open.
Analysis
Microsoft's November 2026 Patch Tuesday fixes seven flaws in domain infrastructure and server roles scored CVSS 3.1 9.8 that need no credentials over the network (the release carries further 9.8 rows, DirectMusic among them, that are not covered here (Microsoft, 2026-11-10)); the only record Microsoft marks as exploited in this release is the Outlook zero-day, which is a separate item, and none of these rows is marked exploited or publicly disclosed (Microsoft, 2026-11-10; BleepingComputer, 2026-11-10). Two have mechanics that make the timeline short. CVE-2026-85844 is an authentication bypass in Windows Kerberos: an unauthenticated attacker sends crafted Kerberos authentication traffic and relays the resulting authentication to an affected domain controller, with no user interaction (Microsoft, 2026-11-10). CVE-2026-116928 is an out-of-bounds write in the Windows Search component that Exchange Server uses: an attacker emails a crafted attachment, Exchange indexes it automatically, so "the recipient does not need to open the email or attachment", and the code runs with the permissions of the processing service (Microsoft, 2026-11-10).
The other five are described more thinly: a double free in Windows DNS (CVE-2026-88218) (Microsoft, 2026-11-10), an out-of-bounds read in Windows DHCP Server (CVE-2026-88243) (Microsoft, 2026-11-10) and a release of an invalid pointer in Windows iSCSI (CVE-2026-88234) (Microsoft, 2026-11-10), each reachable by an in-network attacker calling arbitrary endpoints; an out-of-bounds write in the Windows LDAP service that gives code execution in its context through crafted LDAP calls (CVE-2026-119958) (Microsoft, 2026-11-10); and a heap overflow in SQL Server (CVE-2026-116945) that needs an attacker who controls a network endpoint an integration package connects to, with no credentials or user interaction when the package runs automatically (Microsoft, 2026-11-10). The fixes are the November cumulative updates per release, for example KB5131291 (Windows Server 2016), KB5131085 (Server 2019), KB5131090 (Server 2022) and KB5131080 or KB5131077 (Server 2025), and the November SQL Server updates, for example KB5129299 (2025 CU10) and KB5129300 (2022 CU27).
Cited evidence
An unauthenticated attacker could send specially crafted Kerberos authentication traffic and relay the resulting authentication to an affected domain controller.
Exchange automatically processes the attachment for indexing, so the recipient does not need to open the email or attachment.
Double free in Windows DNS allows an unauthorized attacker to execute code over a network.
An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through a specially crafted set of LDAP calls to execute arbitrary code within the context of the LDAP service.
The attacker does not need SQL Server credentials or additional user interaction when the package runs automatically.
Sources9
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.