The number that broke my brain
Tuesday, Microsoft shipped security updates for 1,235 vulnerabilities. One thousand two hundred thirty-five. In a single Patch Tuesday. The month before, it was 1,411 — a record.
I read that number the way I read weather advisories now: with a nod and a scroll. Not because I am careless. Because somewhere between the 900s and the 1,400s, the count stopped telling me anything I could act on.
Here is the thing though. Buried in that firehose is a number that actually matters: four. Four vulnerabilities that scored a perfect 10.0 on the CVSS scale, in software that runs the back office of most of the planet’s largest companies. And one of them is not even the one attackers are using right now.
The count is a discovery metric, not a risk metric
First, a small honesty about the number itself. BleepingComputer counted 1,235 flaws. CSO Online counted 1,094. Both are right, depending on whether you fold in the 142 Edge fixes and how you treat the 108 flaws Microsoft patched earlier in the month.
That disagreement is the tell. The Patch Tuesday total measures how much code Microsoft’s fuzzers and AI-assisted discovery pipelines churned through. It is a measure of output, not of your exposure. It would be like judging your flood risk by how many sandbags the warehouse produced this week.
What is actually in the November pile: 66 Critical flaws, 536 elevation-of-privilege bugs, 296 remote code execution flaws, 157 information disclosures, and 142 in Edge. Roughly 639 of the 1,235 touch Windows itself. Those are big numbers. They are also, for most organizations, almost entirely irrelevant — because almost none of them are being used against you.
The one that was actually being used
The only flaw in this month’s batch that Microsoft says attackers were actively using is CVE-2026-124194, an Outlook spoofing bug. It leaks your NTLMv2 hash when you open a crafted message file — Windows quietly connects to an attacker’s server and hands over a credential that can be cracked offline or passed along to log in as you.
Notice the score: CVSS 6.5. Moderate. Not Critical. Not 9.8.
That mismatch is the whole argument of this piece. The severity score tells you how bad the bug could be in theory. It tells you nothing about whether someone is using it today. CISA added it to the Known Exploited Vulnerabilities catalog with a federal deadline of November 24. The fix does not even come through Windows Update — it ships in Office, which is why so many organizations will still be exposed next week without anyone noticing.
I have been here before. Earlier today I walked through how to check and patch Git’s recursive-clone RCE, and earlier this week it was SSHole, the OpenSSH authentication bypass. Neither was the biggest bug of its month. Both were the ones that mattered, because one sat in a developer tool chain and the other sat on every internet-facing Linux box.
The four perfect 10s
Now the number that should actually keep you up at night: four.
SAP patched 35 vulnerabilities in its November security updates, and four of them scored the maximum 10.0 on the CVSS scale. Two are tracked together as ICM2SHELL — memory corruption flaws in NetWeaver’s Internet Communication Manager and Web Dispatcher. The third is PROXYGATE, a broken access control flaw in SAP Gateway. The fourth is a missing-authentication bug in the SAML2 Service Provider.
Read what Onapsis, the firm that found three of them, says about PROXYGATE: it “works by convincing the SAP Gateway that an unauthenticated, external attacker is one of the internal application servers.” No SAP user. No password. No user interaction. Full control of the system, as the account that owns the installation.
Let that sit for a second. There is no phishing email. No clicked link. No tired employee at 4:45 PM. An unauthenticated stranger on the internet gets the keys to the ERP that holds your payroll, your procurement, your inventory, your financials.
And SAP is not a niche product. It reported more than 36 billion euros in revenue in fiscal 2025 and serves 99 of the 100 largest companies in the world. CISA has flagged 14 SAP flaws as actively exploited since November 2021, three of them abused by ransomware groups.
This is the part of Patch Tuesday that never makes the tech news roundups. Not a flashy zero-day in a Microsoft product — a load balancer in an ERP stack that half the Fortune 500 runs and almost nobody outside IT has heard of.
Thirty-three zero-days and a cloud pulled offline
If SAP was the quiet disaster, N-able was the loud one.
The same week, a security researcher publicly disclosed 33 zero-day vulnerabilities in N-able’s N-central platform, along with proof-of-concept exploits. BleepingComputer counted the batch at “30+.” N-able’s response was to take its hosted N-central cloud environments offline while it worked on a hotfix.
Think about what that means. A vendor did not just ship a patch. It pulled the drawbridge up on its own customers because the flaws were already public and already weaponized. That is the nightmare scenario for any organization running a managed service — and it is the scenario that has become routine.
The same week brought the sshole OpenSSH and musl authentication bypass, a Zyxel switch zero-day exploited against nearly 1,000 devices, and a Barracuda email gateway flaw that went from patch to exploitation in a week. The zero-day pipeline is not a pipeline anymore. It is a fire hydrant someone knocked over.
Why the firehose got this wide
You might be wondering how we got here. The answer is uncomfortable: we got better at finding bugs.
Microsoft says it is using AI to find and patch vulnerabilities. So does Google — back in August, its AI-assisted pipeline fixed 1,072 Chrome security bugs in two releases, more than the previous 23 milestones combined. I wrote about that at the time, in Google’s AI Just Fixed 1,072 Chrome Security Bugs, and I called it a triumph. I still think it is. But it has a consequence nobody wanted to talk about: the faster you can find bugs, the faster the patch list grows, and the further the list outruns the team whose job it is to apply it.
The bottleneck in security has moved. It used to be finding the flaws. Now it is deciding which of the 1,235 you can afford to fix this week, which can wait, and which you will accept as risk because testing the patch would take longer than the patch is worth.
That is not a tooling problem. It is an attention problem. And attention does not scale with a fuzzer.
What I actually do on Patch Tuesday
I manage an ICT division, and I have stopped reading the totals. Here is the short version of what I watch instead.
One: KEV before CVSS. If CISA’s Known Exploited Vulnerabilities catalog lists it, it goes to the front of the line, whatever its score. CVE-2026-124194 is a 6.5. It is also the one attackers were using. That is the only ordering that matters.
Two: exposed before severe. A 9.8 on an internal-only system is a problem for later. A 7.5 on the VPN appliance that faces the internet is tonight’s problem. Attackers do not care about your severity ranking. They care about what they can reach.
Three: test the patch, not just the bug. The reason most organizations fall behind is not that they do not know about the patches. It is that they do not trust them. A bad cumulative update can take down a production server faster than any exploit. So we stage, we snapshot, and we patch the things that cannot break first.
The boring work is the work
There is a bitter irony in this week. While the security industry chased the shiny new thing — CrowdStrike alone spent $495 million this month buying the AI agent security category, as I covered in CrowdStrike Bought the AI Agent Security Category — the thing that would have actually helped most organizations was the unglamorous work of applying 1,235 patches and checking four SAP appliances.
I am not against AI in security. I use it. But I have learned to be suspicious of any security story where the fix is another product. The fixes that matter this month are a calendar reminder, a test environment, and a team that has the authority to say “we are patching the Exchange server tonight, yes, even though it is quarter-end.”
So the next time you see a headline about a record Patch Tuesday, do not do what I used to do. Do not read the number and feel the dread. Ask a better question: of all of these, which ones are being used, which ones can be reached, and which ones can we actually fix by Friday?
The count is noise. The four are the signal. And the four are patchable — if you start now.