November 2026 RDP Vulnerabilities: Patch Your Windows VPS Now

Microsoft’s November 2026 Patch Tuesday landed on 10 November, and if you run a Windows VPS, this one deserves your attention more than most. The November 2026 RDP vulnerabilities include four fresh flaws in the Remote Desktop client itself — the worst of them, CVE-2026-119934, scores 8.8 and lets a malicious server run code on your machine — plus a Critical remote code execution bug in CredSSP, the protocol that carries your credentials every time you connect, and a Critical privilege escalation in Remote Desktop Services. All of that sits inside a release of 1,235 fixes, the second largest Patch Tuesday in Microsoft’s history.

This is the second month in a row that RDP has headlined Patch Tuesday. October’s round brought the RD Gateway flaws we covered last month; November’s round hits the other end of the connection — the client you connect from, and the credential protocol underneath it. If you manage a Windows VPS from your own PC, both ends of your setup are in scope this month. In this guide we will go through exactly what was fixed, which flaws matter most for a VPS owner, how to check whether your server is already patched, and what to do if you cannot patch today.

• November’s Patch Tuesday in Numbers
• November 2026 RDP Vulnerabilities: The Four Client Flaws
• CVE-2026-119934: The 8.8 Double-Free Flaw
• CredSSP: The Critical Flaw Underneath Your RDP Sessions
• Remote Desktop Services: A Critical Privilege Escalation
• The Exploited Zero-Day: Outlook Steals Your NTLM Hash
• NTLM Signing Phase 1 Starts Now — and Gets Strict in May 2027
• Which Builds Are Safe? Check Your VPS Against This Table
• How to Patch Your Windows VPS in Four Steps
• What to Do If You Cannot Patch Today
• Frequently Asked Questions
• The Bottom Line

November’s Patch Tuesday in Numbers

Microsoft shipped fixes for 1,235 vulnerabilities on 10 November 2026. Only October’s 1,411 fixes were ever bigger, which makes November the second largest Patch Tuesday ever. Sixty-six of the fixes are rated Critical, and 48 of those are remote code execution. By category, the month breaks down to 536 privilege escalation bugs, 296 remote code execution bugs, 157 information disclosure bugs, 46 denial of service bugs, 27 security feature bypasses and 22 spoofing flaws. Put the last three months together — September’s 966, October’s 1,411 and November’s 1,235 — and Microsoft has shipped 3,612 fixes in a single quarter. The nine months before that added up to 1,765.

One bug in the pile is confirmed exploited right now: CVE-2026-124194, an Outlook flaw that steals NTLM hashes through an email. We will come back to it, because it matters to anyone who reads mail on the same machine they use to manage servers. But the RDP story is the one that belongs on a VPS blog, so let us start there.

November 2026 RDP Vulnerabilities: The Four Client Flaws

Microsoft fixed four vulnerabilities in the Windows Remote Desktop client on 10 November. All four are rated High, and three of them can be reached over a network connection. Here is the short version:

CVE	Flaw	CVSS	How it is reached
CVE-2026-119934	Double-free remote code execution	8.8	Victim connects to a malicious RDP server
CVE-2026-119858	Heap buffer and integer overflow RCE	7.5	Network; depends on protocol settings
CVE-2026-119390	Heap buffer overflow, local code execution	7.8	Low-privileged local attacker
CVE-2026-95964	Race-condition remote code execution	7.5	Network; needs precise timing

Microsoft reported no exploitation at publication time for CVE-2026-119934, CVE-2026-119390 and CVE-2026-95964. That is good news, but it is the kind of good news with a short shelf life: client-side RDP flaws have been exploited before, and the details are now public. The patch window here is measured in days, not months.

CVE-2026-119934: The 8.8 Double-Free Flaw

The headline flaw is CVE-2026-119934, a double-free bug in the Remote Desktop client. In plain terms, the client releases the same area of memory twice while processing a response from the server it is connected to. A malicious server can send a crafted response that corrupts the client’s memory handling and ends up running the attacker’s code on your machine. The CVSS score is 8.8, the highest of the four, and Microsoft rates it Important.

What makes this one different from a server-side bug is the direction of trust. You are not being attacked because your VPS is exposed to the internet. You are attacked because you connected to something hostile — a server an attacker controls, reached through a phishing email, a fake support session, or a connection file (.rdp) that somebody talked you into opening. No account on your machine is needed beforehand, but user interaction is: you have to make the connection. That is also what makes it practical for attackers. Rogue RDP phishing campaigns already exist — emails carrying .rdp files that point victims at attacker-controlled servers — and this flaw gives those campaigns a much sharper payload than the credential theft they relied on before.

The affected list covers the Remote Desktop client on Windows 10, Windows 11 and Windows Server, so both your admin workstation and any Windows Server box you use as a jump host are in scope. If you ever connect from a server to another server — a common setup when one VPS manages the rest — patch the jump host first. It is the machine that holds the keys to everything else.

CredSSP: The Critical Flaw Underneath Your RDP Sessions

The RDP client bugs are not the only November fix that touches remote desktop. CVE-2026-119962 is a Critical remote code execution flaw in CredSSP, the Credential Security Support Provider — the protocol that carries your username and password (or smart card credentials) from your machine to the server when you connect over RDP or WinRM. If you manage servers remotely, you use CredSSP whether you know its name or not.

Microsoft has not published a CVSS score in its summary this month, only its own severity rating, so there is no number to quote for this one — but “Critical RCE in the protocol that carries your credentials” is a sentence that should be enough on its own. CredSSP sits below the RDP session, which means a flaw there is not limited to one application’s bugs: it is in the trust layer that every remote management session depends on. It goes in the same patch window as the client flaws, on every machine that makes or receives RDP connections.

Remote Desktop Services: A Critical Privilege Escalation

The third RDP-adjacent fix is CVE-2026-119957, a Critical privilege escalation in Remote Desktop Services itself — the server-side component that accepts your RDP connections. No exploitation has been reported, and Microsoft has not said the flaw is remotely exploitable on its own. But the combination is what matters: an exposed RDP port plus a Critical privilege escalation on the same service is exactly how ransomware operators start their week. If an attacker gets any foothold on the box — a low-privileged account, a web application flaw, a stolen password — this is the kind of bug that turns that foothold into full control.

It is also worth remembering what October fixed on the server side, because the two months tell one story. October’s Patch Tuesday brought CVE-2026-70187, an unauthenticated remote code execution flaw in RD Gateway scoring 8.1, plus an RD Gateway information disclosure bug and an RDP client RCE. November follows up by fixing the client, the credential protocol and the server service. Two months, both ends of the connection. If you patched in October and skipped November, you are half done.

The Exploited Zero-Day: Outlook Steals Your NTLM Hash

The one flaw Microsoft confirms is being exploited right now is not an RDP bug at all. CVE-2026-124194 is in Outlook, and Microsoft rates it Moderate — which is the least useful fact about it. A crafted message makes Outlook authenticate to an attacker-controlled network location without showing the external content warning that normally stands between you and that connection. Windows then helpfully tries to log in to that location, handing over your NTLMv2 hash. The attacker cracks it offline or relays it live to a service that still accepts NTLM.

Microsoft says exploitation requires network connectivity and user interaction. Both of those are true of reading an email. The affected list includes Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, so this is not a legacy-only problem. And it is not alone: November also fixed twenty Outlook remote code execution bugs, three of them Critical (CVE-2026-110043, CVE-2026-111309 and CVE-2026-110068). Last month there were five Outlook RCEs. This month there are twenty.

Why does an Outlook bug belong in a VPS article? Because of where you read your email. Plenty of server admins check mail on the same Windows machine they RDP from, sometimes on the server itself. A stolen NTLM hash from that machine is a stolen identity for your whole environment — and if NTLM is still accepted by your file server, your Exchange server or your domain controller, the hash alone is enough. Patch Outlook on every machine that touches your servers, then go and find out where NTLM is still accepted. The patch fixes the delivery; it does not fix the underlying exposure.

NTLM Signing Phase 1 Starts Now — and Gets Strict in May 2027

November’s updates also begin a change that every Windows admin needs on their calendar. Phase 1 of Microsoft’s NTLM signing enforcement kicked off on 10 November 2026: Windows clients now offer NTLM signing on all connections by default, while servers still accept both signed and unsigned clients. Audit events track the clients that are not signing, so you can see what would break before anything is enforced.

Phase 2 is scheduled for May 2027, and it is considerably stricter: Windows Server will require NTLM signing by default, and clients that do not offer signing will be rejected. Microsoft says all supported versions of Windows Server can already do NTLM signing — this is a staggered enforcement, not a new capability — so the work between now and May is auditing, not upgrading. Check the audit events after this month’s patch, find the legacy devices and applications that still connect unsigned, and fix or replace them while the server still accepts them. The related flaw behind the push, CVE-2026-118737, is a Critical remote code execution bug in the Windows RPC Runtime — the service listening on port 135 of every Windows box on your LAN.

Which Builds Are Safe? Check Your VPS Against This Table

Patch Tuesday updates are cumulative, so one install covers everything — but only if the install actually happened. The fastest check is your build number. Run winver, or check Settings > System > About, and compare against the fixed builds below. If your build is lower than the one listed, the November fixes are not installed.

System	November update	Fixed build
Windows 11 26H2	KB5132061	26300.9974
Windows 11 25H2	KB5132061	26200.9974
Windows 11 24H2 (Enterprise / Education)	KB5132061	26100.9974
Windows 11 23H2	KB5131087	22631.7711
Windows 11 26H1	KB5132059	28000.3501
Windows 10 22H2 (ESU)	KB5131096	19045.7846
Windows Server 2025	November cumulative update	10.0.26100.33822
Windows Server 2022	November cumulative update	10.0.20348.5870

Two support deadlines fall in the same window, and they matter more than the build numbers. Windows 11 24H2 Home and Pro reached their end-of-updates date on 13 October 2026 — those editions do not get this patch at all, and the only fix is moving to 25H2 or 26H2. Windows 11 23H2 Enterprise and Education reached end of updates on 10 November 2026, the same day this Patch Tuesday shipped; KB5131087 is its final update. If your VPS or your admin PC is on either of those, the November flaws are not going to be fixed where you are. Upgrade the OS, or retire the machine from anything that touches RDP.

How to Patch Your Windows VPS in Four Steps

Patching a VPS is the same job as patching any Windows machine, with one extra rule: never start a patch run you cannot recover from. Snapshot the server first if your provider offers it, and pick a maintenance window — the November update needs a reboot, and your RDP session will drop when it happens.

Step 1 — Check your current build. Connect to the VPS and run this in PowerShell. It prints the build and the update revision number, which is the part that tells you whether November is installed:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
  Select-Object CurrentBuild, UBR, DisplayVersion

# Windows Server 2025 patched: CurrentBuild 26100, UBR 33822
# Windows Server 2022 patched: CurrentBuild 20348, UBR 5870
# If UBR is lower, the November fixes are not installed yet.

Step 2 — Install the updates. On a desktop Windows VPS, Settings > Windows Update > Check for updates will find KB5132061 (Windows 11) or the Server cumulative update. On Server Core, or if you prefer the command line, sconfig option 6 downloads and installs updates. From PowerShell, the PSWindowsUpdate module does the same job without a GUI:

Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate -Install -AcceptAll -AutoReboot

# After the reboot, confirm the KB actually landed:
Get-HotFix | Where-Object { $_.HotFixID -like 'KB513*' } |
  Select-Object HotFixID, InstalledOn

Step 3 — Patch the machine you connect from, too. The client flaws live on your own PC, not on the server. Install the same November update on your admin workstation and on any jump host, and update the Windows App client to 2.0.1489.0 or later if you use it — that is the fixed build for CVE-2026-119390. Patching the server while leaving the client unpatched fixes the wrong end of the connection.

Step 4 — Reboot and verify. Re-run the build check from Step 1 after the reboot and confirm the UBR matches the table above. Then confirm the Remote Desktop client itself picked up the fix: connect to a test server and check that the client version updated — and if the connection fails after patching, work through the usual connection checks before assuming the update broke something. If you use an RD Gateway, confirm its October fix (CVE-2026-70187) is also installed, since November does not re-deliver it.

One honest note: a small number of users reported installation failures with KB5132061 on 10 November, most commonly error 0x800f0993. Update errors after a Patch Tuesday are nothing new — October’s update broke RDP logins outright for some users. If the update fails on your machine, do not just retry it blindly — check the Windows Update troubleshooter, clear the SoftwareDistribution cache, or install the update manually from the Microsoft Update Catalog. A failed install that you assume succeeded is worse than no install at all, because you stop checking.

What to Do If You Cannot Patch Today

Sometimes patching has to wait — a production workload, a change freeze, a server you cannot reboot until the weekend. The November flaws are not a reason to panic, but they are a reason to shrink your exposure until the patch lands. These mitigations cost nothing and do not need a reboot:

• Do not connect to servers you do not trust. The worst RDP client flaw, CVE-2026-119934, only fires when you connect to a malicious server. Do not open .rdp files from emails, chat messages or support tickets you did not expect, and do not let anyone talk you into a “quick remote session” on an unfamiliar host.
• Turn off RDP where it is not needed. If a VPS does not need inbound Remote Desktop, disable it and manage the box over SSH or your provider’s console instead. Every closed port is a flaw that cannot be reached.
• Require Network Level Authentication. NLA forces authentication before a session starts, which keeps unauthenticated attackers away from the RDP service itself. It is one of the first settings in our VPS hardening checklist. Check it with Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication — a value of 1 means NLA is on.
• Put RDP behind a VPN or an RD Gateway. An internet-exposed RDP port is the single biggest risk factor for any Windows server, patched or not. A VPN or gateway means the RDP service is never directly reachable, which takes the server-side flaws off the table entirely.
• Find where NTLM is still accepted. After this month’s patch, review the NTLM signing audit events in the Security log. Anything still authenticating unsigned — a legacy application, an old NAS, a forgotten service account — is a relay target for the exploited Outlook flaw, and it will stop working in May 2027 anyway. Fix it now, while it is still a choice.
• Verify your Defender engine version. November also fixed a Critical RCE in the Microsoft Defender engine itself (CVE-2026-122194), but that one ships through the engine update rather than Patch Tuesday, so it is probably already applied. Check it anyway — an RCE in the scanner fires on files nobody opened.

None of this replaces the patch. Mitigations buy you days; the update buys you the fix. If your change freeze runs past the weekend, escalate it — the client flaws are public now, and the window between disclosure and exploitation has been shrinking every year.

Frequently Asked Questions

Are the November 2026 RDP vulnerabilities being exploited?

Microsoft reported no exploitation at publication time for the four RDP client flaws (CVE-2026-119934, CVE-2026-119858, CVE-2026-119390 and CVE-2026-95964), nor for the CredSSP and Remote Desktop Services flaws. The one flaw confirmed exploited in November is CVE-2026-124194, the Outlook NTLM hash disclosure. “Not exploited yet” is not the same as safe — the details are public, and client-side RDP flaws have been exploited in the past.

Do I need to patch my VPS, my own PC, or both?

Both. The four client flaws live in the Remote Desktop client, which runs on the machine you connect from. The CredSSP and Remote Desktop Services flaws affect the machines on either end of the connection. Patch your admin workstation, your jump host and your VPS in the same window.

I patched in October. Am I covered?

No — October and November fixed different flaws. October’s round covered the RD Gateway RCE (CVE-2026-70187) and related server-side bugs; November’s round covers the RDP client, CredSSP and Remote Desktop Services. You need both months’ updates installed. November’s cumulative update includes October’s fixes, so installing November on a machine that missed October covers both — as long as the install actually succeeds.

What if my Windows 11 24H2 Home or Pro PC cannot get the update?

Windows 11 24H2 Home and Pro stopped receiving updates on 13 October 2026, so KB5132061 is not offered to those editions at all. Upgrade to 25H2 or 26H2 through Windows Update, or move your RDP work to a supported machine. Running an unpatched client against servers you manage is the exact scenario CVE-2026-119934 was built for.

Can I just disable RDP instead of patching?

Disabling inbound RDP protects the server side, and it is good practice where RDP is not needed — RDP gets its bad reputation for a reason. But it does nothing for the client flaws — those fire when you connect outwards to a malicious server, which does not depend on your own RDP port being open. If you ever RDP from a machine, that machine needs the patch regardless of whether it accepts incoming connections.

The Bottom Line

November 2026 is the second month in a row that Patch Tuesday has been dominated by remote desktop — and the second largest Patch Tuesday ever, with 1,235 fixes. The four new RDP client flaws, the Critical CredSSP bug and the Remote Desktop Services privilege escalation all land on the same workflow: you, connecting to your Windows VPS. Patch the server, patch the machine you connect from, and check the build number afterwards instead of assuming the update worked. While you are in there, patch Outlook too — the one exploited flaw this month steals NTLM hashes through an email, and it only needs you to open a message.

If you patched in October, do not let that lull you into skipping November. October fixed the gateway; November fixed the client, the credentials and the service. Both months are one story, and the story ends when every build number in the table above matches. That is a thirty-minute job, including the reboot — and it is the cheapest security work you will do all month.