What Microsoft released on 10 November 2026

Microsoft published its November 2026 security updates on Tuesday 10 November. The release lists 1,439 CVEs across Microsoft products, including Chromium-based Edge and Azure Linux entries. Microsoft rates 70 of them Critical.

• Eight Critical vulnerabilities are in Windows Hyper-V, the virtualization layer that runs virtual machines on a Windows host. All eight are elevation of privilege flaws.
• Critical flaws also affect Windows Server itself, including LDAP, Windows Search, Schannel, the Credential Security Support Provider (CredSSP), IIS, Message Queuing and the SMB server driver.
• Only one vulnerability in the whole release was marked as exploited when it was published: an Outlook spoofing flaw rated Moderate. None of the Hyper-V flaws were known to be exploited, and Microsoft rated them “Exploitation Less Likely”.

“Not exploited yet” is not a reason to wait. Once a fix is public, attackers can compare the patched and unpatched files to find the flaw, so the gap between a patch release and the first working exploit keeps getting shorter. The safest time to patch is straight after release.

Who needs to act

This update matters for every Windows Server, wherever it is hosted. What you need to do depends on how you run Windows:

The eight Critical Hyper-V vulnerabilities

The table lists Microsoft’s data for each Hyper-V CVE rated Critical this month. Seven of them affect Windows Server. The eighth, CVE-2026-113753, affects Windows 11 version 26H1 only.

Most of these flaws are rated high attack complexity, because the attacker has to win a race condition. That makes them harder to exploit, not impossible. Microsoft still rates all eight Critical, because a successful attack crosses the boundary between a virtual machine and the host.

Why Hyper-V flaws matter on a VPS host

Every UnderHost Windows Cloud VPS is a Hyper-V virtual machine on a physical host node. The hypervisor keeps every virtual machine separate from the host and from the other virtual machines on the same node. That isolation is the basic promise of virtual hosting.

A guest-to-host escape breaks that promise. Four of this month’s Critical Hyper-V flaws let code running inside a guest virtual machine run on the host. An attacker who reaches the host could, in principle, read or change data in other virtual machines, stop them, or install malware on the host.

The starting point can be any virtual machine on the node: one the attacker rents, or a customer server that was already compromised. That is why a host node has to be patched even when every customer on it runs a fully updated server.

What UnderHost did

UnderHost installed Microsoft’s November 2026 security updates on the Hyper-V host nodes behind Windows Cloud VPS on 11 November 2026, the day after release, in all three locations:

This was emergency maintenance. We patched immediately rather than waiting for a scheduled maintenance window, because a host node flaw puts every server on that node at risk, including servers whose owners did everything right.

Installing the host updates meant restarting every Windows VPS in the three locations on 11 November. We know an unplanned restart is disruptive, especially for trading platforms, bots and other always-on software, and we did not take that decision lightly. Protecting every customer on each node outweighed the cost of waiting.

If something on your VPS did not come back after the restart, connect with Remote Desktop and start it again. To avoid this next time, set important software to start with Windows, for example as a Windows service or a scheduled task that runs at startup.

Your Windows Server still needs this month’s updates

Several Critical flaws this month are in components that run inside a Windows Server VPS. The ones that matter most on an internet-facing server:

The fixes come in the monthly cumulative update for each Windows Server version:

UnderHost Windows Cloud VPS plans run licensed Windows Server 2019, 2022 or 2025. A later cumulative update includes these fixes, so a server with December’s update installed is covered too.

One-command check: is your server patched?

Connect to your VPS with Remote Desktop, open PowerShell, and paste this command. It finds your Windows Server version and checks whether the matching November 2026 update is installed. It changes nothing on the server.

$os = Get-CimInstance Win32_OperatingSystem
$kb = @{ '14393' = @('KB5131291'); '17763' = @('KB5131085')
         '20348' = @('KB5131090'); '26100' = @('KB5131080','KB5131077') }[$os.BuildNumber]
if ($os.ProductType -eq 1 -or -not $kb) {
  "$($os.Caption) (build $($os.BuildNumber)): this check covers Windows Server 2016 to 2025 only."
} elseif (Get-HotFix -Id $kb -ErrorAction SilentlyContinue) {
  "$($os.Caption): the November 2026 update ($($kb -join ' or ')) is installed."
} else {
  "$($os.Caption): $($kb -join ' or ') not found. Run Windows Update and restart. A newer cumulative update also covers you."
}

You will see one of three results: the update is installed, the update is missing, or your system is not a Windows Server version this check covers. If it is missing, install it as shown below, and if that fails, see Update missing or failing? How to fix it. To see the most recent updates on the server instead, run:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, Description, InstalledOn

Install the updates

Take a backup or a snapshot first if your server runs anything important. Then use whichever method suits your server.

With the desktop (Desktop Experience)

1. Open Settings, then Windows Update (on Windows Server 2019: Update & Security, then Windows Update).
2. Click Check for updates and let the cumulative update install.
3. Restart when Windows asks. The fixes are not active until the server restarts.

From PowerShell or Server Core

Windows Server includes the sconfig tool. Run it, choose the Install updates option, and pick all quality updates:

sconfig

After the update installs, restart the server and run the check again:

Restart-Computer

A restart disconnects your Remote Desktop session for a few minutes. If you run trading platforms or other always-on software, plan the restart for a quiet moment, and check that the software starts again afterwards.

Update missing or failing? How to fix it

If the check says the November update is not installed, work through these steps in order. Run PowerShell as Administrator.

1. Finish a pending restart

Updates often install but wait for a restart. This returns True when Windows is waiting to restart:

Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending'

If it returns True, restart the server with Restart-Computer and run the check again.

2. Check free disk space

A cumulative update needs several gigabytes free on the system drive. Check it with:

Get-PSDrive C | Select-Object @{n='FreeGB';e={[math]::Round($_.Free/1GB,1)}}

If less than about 10 GB is free, delete old files or empty the recycle bin, then try Windows Update again.

3. Check whether a policy holds updates back

Group Policy or WSUS settings can delay or block updates. If this command shows a WUServer address or deferral settings, updates come from that server or wait for the set number of days:

Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -ErrorAction SilentlyContinue

If nothing is shown, no policy is set. If you did not set these values yourself, ask whoever manages the server before you change them.

4. Repair Windows Update (one command)

If Windows Update fails with an error or keeps offering the same update, paste this block. It repairs the Windows component store, resets the Windows Update download cache and starts the services again. It can take 15 to 30 minutes. Restart the server afterwards, then run Windows Update again.

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow
Stop-Service wuauserv, bits, cryptsvc -Force
Rename-Item C:\Windows\SoftwareDistribution "SoftwareDistribution.old.$(Get-Date -Format yyyyMMddHHmm)"
Start-Service cryptsvc, bits, wuauserv
"Repair finished. Restart the server, then run Windows Update again."

5. Install the update by hand

If Windows Update still fails, download the update for your version from the Microsoft Update Catalog. Search for the KB number from the table above (KB5131080, KB5131090, KB5131085 or KB5131291), download the .msu file, then install it:

wusa.exe C:\Updates\your-update-file.msu /quiet /norestart
Restart-Computer

If the catalog lists more than one file for your version, follow the install order in Microsoft’s article for that KB number. To see why an earlier attempt failed, run Get-WindowsUpdateLog, which saves a readable WindowsUpdate.log to your desktop.

6. Running Windows Server 2012 or 2012 R2?

These versions are past the end of their normal support, and their security updates install only on servers enrolled in Extended Security Updates. Microsoft’s November 2026 data lists KB5126835 for Windows Server 2012 and KB5126836 for 2012 R2, but they cover far fewer vulnerabilities than the newer versions. The Critical LDAP flaw, for example, has no fix listed for 2012. Move the workload to Windows Server 2022 or 2025. A new Windows Cloud VPS with a supported version is often the quickest way to do that.

Still stuck? UnderHost customers can open a ticket through @CustomerPanel, or use our emergency support at $39.95 an hour.

Hyper-V on a dedicated server: you are the host

If you run Hyper-V on your own dedicated server, for test labs, client environments or virtual machines you resell, your server is the host node. The eight Hyper-V fixes are yours to install, and they matter most if anyone other than you can run code inside one of your virtual machines.

1. Check whether the Hyper-V role is installed

Get-WindowsFeature -Name Hyper-V | Select-Object Name, InstallState

If InstallState is Installed, the Hyper-V fixes apply to this server. If it is Available, Hyper-V is not enabled, and you only need the regular update.

2. See what happens to your virtual machines during the restart

Get-VM | Select-Object Name, State, AutomaticStopAction, AutomaticStartAction

AutomaticStopAction decides whether each virtual machine is saved, shut down or turned off when the host restarts. AutomaticStartAction decides whether it starts again afterwards. Set important virtual machines to start automatically before you patch.

3. Patch in the right order

1. Back up the virtual machines you cannot afford to lose. A checkpoint is not a backup.
2. Update the host with Windows Update or sconfig, then restart it.
3. Check that every virtual machine is running again: Get-VM | Where-Object State -ne 'Running'
4. Update each virtual machine that runs Windows, and restart it.

On a Hyper-V failover cluster, use Cluster-Aware Updating, so virtual machines move to another node while each host restarts.

Reduce exposure on a Remote Desktop server

Patching closes these flaws. These checks reduce what an attacker can reach the next time a flaw appears.

1. See which risky services are listening

This lists listeners on the RPC, NetBIOS, SMB, LDAP, Message Queuing and Remote Desktop ports:

Get-NetTCPConnection -State Listen | Where-Object LocalPort -in 135,139,445,389,636,1801,3389 | Sort-Object LocalPort | Select-Object LocalAddress, LocalPort, OwningProcess

A single-server VPS rarely needs SMB (445), LDAP (389 and 636) or Message Queuing (1801) open to the internet. Block what you do not use in Windows Defender Firewall.

2. Keep Network Level Authentication on

Network Level Authentication (NLA) makes users sign in before a full Remote Desktop session starts. This command returns 1 when it is on:

(Get-CimInstance -Namespace root/cimv2/TerminalServices -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-tcp'").UserAuthenticationRequired

3. Allow Remote Desktop only from your own IP

If you always connect from a fixed IP address, limit the built-in Remote Desktop firewall rules to it. Replace 203.0.113.10 with your own public IP:

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 203.0.113.10

4. Use strong, unique passwords

Remote Desktop servers are scanned for weak passwords around the clock. Use a long, unique password for every administrator account, and remove accounts you no longer use. For more, see our Windows VPS and Remote Desktop guide.

Not an UnderHost customer? Questions to ask your provider

Everything in the patching sections above works on any Windows Server, wherever it is hosted. The host is the part you cannot patch yourself on a VPS. Ask your provider:

• Have your host nodes received Microsoft’s November 2026 updates, including the Hyper-V fixes? On what date?
• Will my server be restarted for host maintenance, and how will you tell me?
• Which Windows Server versions do you offer, and is the licence included?
• Do you install Windows updates inside my server, or is that my job?

Clear, dated answers are a good sign. If you would rather host with a provider that patched its Windows VPS host nodes the day after release, see the options below.

Windows hosting at UnderHost

Windows Cloud VPS

Our new Windows Cloud VPS line-up has nine plans, from 1 vCore to 32 vCores, in Canada, the Netherlands and Hong Kong. You choose the location at checkout.

Every plan includes:

• Licensed Windows Server 2019, 2022 or 2025
• Full administrator access over Remote Desktop
• NVMe storage and unmetered bandwidth
• One dedicated IP address (additional IPv4 addresses are $4.95/month)
• Free DDoS protection
• 24/7 support

Windows Cloud VPS suits Remote Desktop work, MetaTrader 4 and 5 or cTrader, .NET applications, IIS websites and MSSQL databases. Prices are in USD and current on 12 November 2026. See the Windows Cloud VPS page for the latest prices and to order.

Dedicated servers

UnderHost offers Windows Server on dedicated servers, for workloads that need a whole machine or to run your own Hyper-V host. Contact our team through @CustomerPanel to choose the Windows Server version and licence for your server.

Windows Server Management

If you would rather not patch Windows servers yourself, UnderHost Server Management covers Windows Server, including patch management, Hyper-V, IIS, SQL Server and Active Directory. Management for Windows servers starts at $99.95 a month and includes 24/7 monitoring and security patching. For one-off help, emergency support is $39.95 an hour.

Sources

• Microsoft Security Update Guide: November 2026 release notes
• Cyber Security Agency of Singapore: November 2026 Monthly Patch (AL-2026-160)
• Microsoft’s CVE pages, linked in the tables above

Need help with an update? Open a ticket through @CustomerPanel.