Patch Tuesday November 2026: What to Patch First

For Patch Tuesday November 2026, patch the Windows systems that face the internet first (web servers, Exchange, SharePoint and remote access), then everything else, and read Microsoft's official release notes for the exact list of fixes.

This post is for owners of small businesses who run their own Windows servers, or who pay someone to. You will get a clear patch order, a table to decide what is urgent, and copy-pasteable commands to check where you stand today.

One note on scope. Microsoft's scheduled release date is the second Tuesday of the month, 10 November 2026. Exact CVE numbers and counts change as Microsoft revises its notes, so check the live Microsoft Security Update Guide release notes for November 2026 for the current list. The steps below show you how to read them.

What Patch Tuesday is, in plain English

Microsoft ships its regular security fixes on the second Tuesday of each month. People call it Patch Tuesday. Each fix is tracked with a CVE number (a public ID for one specific security flaw, like CVE-2026-12345).

A zero-day is a flaw that attackers were already using, or that was made public, before a fix existed. It does not mean the bug is scarier than others. It means the clock started before you got the patch, so those fixes go to the top of your list.

Microsoft marks these in the Security Update Guide. Look for the words "Exploitation Detected" or "Publicly Disclosed" next to a CVE.

Do you even need to act?

Many small sites never touch Windows patching. If your site runs on any of these, your host handles the server:

• Shopify, Wix, Squarespace or another hosted builder.
• Managed WordPress hosting.
• A Linux shared host or a managed cloud platform.

You still have PCs and laptops, so update those. But the server-side items below do not apply to you.

You need to act if you run any of these yourself:

• A Windows Server with IIS (Internet Information Services, Microsoft's web server software).
• Exchange Server (on-premises email).
• SharePoint Server (on-premises document sharing).
• A Windows machine with Remote Desktop open to the internet.

What is in the November 2026 update

A Patch Tuesday release covers many Microsoft products at once. For the systems in this post, here is what to look for in the live release notes:

• Windows and Windows Server: the biggest group of fixes. This also covers Remote Desktop, because it is part of Windows.
• IIS-related components: IIS itself is patched through Windows Update, so any fix that touches it arrives in the Windows and Windows Server updates.
• Exchange Server: security updates are separate downloads, and only for versions Microsoft still supports.
• SharePoint Server: also a separate download, installed on every server in the farm.

The total CVE count and the list of CVEs marked "Exploitation Detected" or "Publicly Disclosed" can change after publication. We do not copy a fixed number here. Open the November 2026 release notes, find any flagged CVE that hits a product you run, and move it to priority 1 in the table below.

What to patch first: a priority table

Use this order. It follows one idea: the more reachable a system is from the internet, the sooner it gets the update.

The U.S. government keeps a list of flaws known to be used in real attacks. Check it against your software: the CISA Known Exploited Vulnerabilities catalog. If a Microsoft CVE from this month appears there, move it to priority 1.

Step 1: Read the November 2026 release notes in five minutes

1. Open the November 2026 release notes in the Security Update Guide.
2. Filter by the products you run. For example, "Windows Server 2022", "Exchange Server" or "SharePoint Server".
3. Sort by exploitability. Note any CVE that says "Exploitation Detected".
4. Write down the severity (Critical, Important) for each hit.
5. Check each CVE on the National Vulnerability Database if you want a second description in plain terms.

If nothing in your product list is exploited, you still patch. You just do it on a calmer schedule.

Step 2: See what you are running and what is installed

On each Windows machine, open PowerShell as administrator. These commands only read information and change nothing.

Check your Windows version (works on Server Core and desktop installs):

Get-ComputerInfo | Select-Object WindowsProductName, OsVersion, OsBuildNumber

On a machine with a desktop, you can also run winver to open a small window that shows the same version. It does not work on Server Core.

See the most recent updates installed:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

Check your IIS version (IIS itself is patched through Windows Update, so use Get-HotFix to see patch level):

Get-ItemProperty HKLM:\SOFTWARE\Microsoft\InetStp | Select-Object VersionString

Check your Exchange build (run in Exchange Management Shell):

Get-ExchangeServer | Format-List Name,AdminDisplayVersion

Compare the Exchange build to Microsoft's table in the Exchange Server build numbers and release dates page. If your build is older than the latest security update, you are behind.

Step 3: Back up, then patch

Take a full backup or image before patching. A patch that breaks something is rare, but a restore point turns a bad day into a short one.

For virtual machines, a snapshot taken just before patching is fine as a short-term safety net for ordinary servers. It is not a backup. Microsoft does not support VM snapshots as an Exchange backup. Reverting a snapshot of a domain controller can cause replication problems (known as USN rollback), so use a proper backup for those.

Then apply updates:

• Windows Server with a desktop: Settings, then Windows Update, then Check for updates, then install and restart.
• Windows Server Core: run sconfig and choose the Download and Install Updates entry (menu numbers can differ on newer Windows Server versions, so pick the Download and Install Updates entry; it is option 6 on Windows Server 2019 and 2022). Then follow the prompts.
• Exchange: download the security update from the Microsoft release notes and run it from an elevated prompt, as Microsoft's installation notes describe. Plan for a service restart. Exchange Server 2016 and 2019 reached end of support in October 2025, so owners on those versions may not be offered the November security update at all. If you run Exchange 2016 or 2019, check whether Microsoft is still offering you a security update for your version. If not, plan to move to Exchange Server Subscription Edition or a hosted email service.
• SharePoint: install the update on every server in the farm. Afterward, run the SharePoint Products Configuration Wizard (or PSConfig) so the databases upgrade.

Patch one server at a time if you have more than one. That keeps your site up while you work.

Step 4: Verify the patch worked

A patch can be "installed" but not active until a restart. Check these:

• For Windows, run Get-HotFix and confirm the new KB number appears in Get-HotFix or Update history. The release notes name the KB (the article ID for the update) for each product. If the KB is not listed, also check Settings, Windows Update, Update history, or run Get-WindowsUpdateLog.
• For Exchange, re-run Get-ExchangeServer | Format-List Name,AdminDisplayVersion and compare the build number to Microsoft's build numbers table. Exchange security updates (.msp packages) and SharePoint updates often do not appear in Get-HotFix, so a missing entry there is not a sign of failure.
• Confirm the server restarted. Windows Update shows "Restart required" if it has not.
• For Exchange, you can also run Microsoft's Exchange Health Checker. It reports your build and flags missing updates.
• Load your site, log in, and run a test checkout or form. Look for errors in the IIS logs, usually under C:\inetpub\logs\LogFiles.

Step 5: Reduce the damage of the next bad month

Patching is one layer. These habits make the next Patch Tuesday less stressful:

• Close Remote Desktop to the open internet. Put it behind a VPN. If RDP must stay reachable, restrict it by IP address in the firewall, and also use Network Level Authentication, strong passwords or multi-factor authentication, and ideally a Remote Desktop Gateway. An IP allow-list alone is not enough.
• Turn on automatic updates for workstations, and schedule a monthly window for servers.
• Keep a list of what you run. You cannot patch what you forgot you have. Old test servers and forgotten staging sites are common gaps.
• Retire software that no longer gets security fixes. Microsoft stops issuing updates for old versions. Check each product's lifecycle on the Microsoft Lifecycle site.
• Check your public web server's settings, not just its updates. Our free security headers tool shows missing protections in a few seconds.

Patching is not the whole picture

Windows updates fix flaws in Microsoft's software. They do not fix mistakes in your own site, such as a weak login, an exposed admin page or a leaky form. Those need a different kind of check.

If you want a quick outside view, run the free website security check. It is a passive look at your public site, with no card and no login. For a wider question, see our guide on whether your website is hackable.

If you suspect something already went wrong, go to what to do if your website is hacked first.

When you want a person to look deeper, a Circuit audit at $49 has a real security engineer test your site by hand and send a written report with severity, evidence and exact fixes. It is a small-site audit, not a compliance certificate or a multi-week enterprise test. If that sounds useful, it is the honest next step. If not, the free check is a good place to start.

Key takeaways

• Patch internet-facing systems first: Exchange, SharePoint, IIS servers and remote access.
• Treat any CVE marked "Exploitation Detected" as urgent, and cross-check it against the CISA KEV catalog.
• Read the official November 2026 release notes for exact CVEs and KB numbers before you patch.
• Back up, patch one server at a time, restart, then verify: Get-HotFix or Update history for Windows, the build number for Exchange, and a real test of your site.
• Close Remote Desktop to the open internet, and retire software that no longer gets updates, including Exchange versions past end of support.