Microsoft’s November 2026 Patch Tuesday fixes 1,093 vulnerabilities, including one actively exploited Outlook zero-day that leaks users’ login credentials. The exploited flaw, CVE-2026-124194, lets an attacker steal a victim’s NTLMv2 hash just by getting them to open a crafted message file, and CISA has given federal agencies until November 24 to patch it. Here is what Microsoft fixed, which flaws matter most, and what to patch first.
The numbers: what Microsoft fixed this month
Microsoft released its November security updates on Tuesday, November 10, 2026, the second Tuesday of the month. By Tenable’s count the release addresses 1,093 newly released vulnerabilities: 63 rated critical, 1,029 rated important, and one rated moderate. SecurityWeek counted 1,094, while the Zero Day Initiative put the figure at about 1,090. Counting the 142 Microsoft Edge (Chromium) flaws separately, BleepingComputer’s total reaches 1,235.
Whatever the exact count, this is a big release, though smaller than October’s Patch Tuesday, which fixed 1,411 flaws including three zero-days. Windows accounts for 726 of this month’s fixes, followed by Office with 174. The updates cover Windows and its components, Office, Exchange Server, SQL Server, SharePoint, Azure services, .NET and Visual Studio, Dynamics, and Xbox.
Only one flaw is marked as exploited in the wild, and none was publicly known before the fix was released. The Zero Day Initiative counted 30 potentially wormable flaws this month, down from 59 in October. That lower count is good news, but it does not mean less risk: the one exploited flaw is the one to act on first.
The exploited Outlook zero-day: CVE-2026-124194
CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook. Microsoft rates it moderate, with a CVSS score of 6.5, and marks it as “Exploitation Detected” in the Microsoft Security Update Guide. CISA added it to its Known Exploited Vulnerabilities catalog on November 10, 2026, with a federal remediation deadline of November 24, 2026.
The moderate rating is misleading. The flaw is under active attack, and the impact is serious: an attacker who exploits it can obtain the victim’s valid NTLMv2 hash and use it to authenticate as that user in follow-on attacks.
How the attack works
An attacker sends the victim a specially crafted message file and convinces them to open it. When the file is opened, Outlook connects to an attacker-controlled network location without displaying the usual external-content warning, and that connection discloses the user’s NTLMv2 hash.
Microsoft says the Preview Pane is not an attack vector, so simply reading an email in the preview pane does not trigger the flaw. The victim has to open the crafted file and have network connectivity for the leak to happen. Microsoft has not said who is being attacked or how widely the flaw has been used, and the flaw was not publicly disclosed before the fix became available.
According to Tenable’s analysis of the Microsoft advisory, the vulnerability was found with the help of Claude, Anthropic’s AI model. Microsoft credits a researcher using the name “nono” and Benoît Sevens with the discovery.
Who is affected and how to fix it
The flaw affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, in both 32-bit and 64-bit editions. The fixed builds are Office LTSC 2024 version 16.0.17932.21140 and Office LTSC 2021 version 16.0.14334.21048, with the corresponding Microsoft 365 Apps update covered by Microsoft’s Office security release notes.
Administrators should install the November Office updates as soon as possible, since exploitation is already underway. For home users, the Microsoft 365 update arrives through the normal Office update channel. Users should also treat unexpected message files with suspicion: an Outlook file attachment from an unknown sender that asks you to open it is the delivery method for this attack.
The critical flaws to patch first
Beyond the Outlook zero-day, several critical flaws in this month’s release deserve immediate attention:
| CVE | Product | Severity | What it is |
|---|---|---|---|
| CVE-2026-116928 | Windows Search | 9.8 | Remote code execution reachable through Exchange Server indexing; effectively zero-click for some configurations |
| CVE-2026-119958 | Windows LDAP | 9.8 | Remote code execution inside LDAP with no login required |
| CVE-2026-119952 | Schannel | 8.1 | Remote code execution; Microsoft marks it “Exploitation More Likely” |
| CVE-2026-118207 | Exchange Server | 8.8 | Remote code execution in Exchange Server |
The Windows Search flaw, CVE-2026-116928, is the one to watch after the Outlook zero-day. It can be reached through Exchange Server indexing, which makes it effectively zero-click in some configurations, and it carries the highest possible severity rating. The LDAP flaw, CVE-2026-119958, is similarly dangerous: an attacker can run code inside LDAP without any login.
The Schannel flaw, CVE-2026-119952, scores 8.1, but Microsoft flags it as “Exploitation More Likely,” which is a strong signal that exploit code is expected soon. Schannel handles TLS in Windows, so this flaw sits in the path of a huge amount of encrypted traffic.
What else is in this month’s release
Windows 11 users get KB5132061 for versions 24H2, 25H2, and 26H2, while KB5131087 covers version 23H2. That 23H2 update is the last one for 23H2 Enterprise and Education editions, so organizations still on 23H2 need to move to a supported version.
The release also includes critical-severity updates for Windows 10, Windows Server 2016 through 2025, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. The pattern of the last few months continues: Microsoft is patching a very high volume of flaws, and much of that volume appears to be driven by AI-assisted vulnerability discovery. The Zero Day Initiative noted that AI is getting better at reversing patches than at finding and exploiting bugs in closed-source software, which may explain why this month has only one exploited flaw despite more than 1,000 fixes.
November also continues a busy season for actively exploited flaws elsewhere in the industry. CISA added four exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on November 9, covering GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH, and IBM Aspera Faspex, with a federal patch deadline of November 12. And Cisco’s Secure Email Gateway zero-day from October is still being patched in the wild, a reminder that email-adjacent attack surfaces are a persistent target.
How to install the November updates
For home users, the simplest path is Windows Update. Go to Settings, then Windows Update, and click “Check for updates.” The November cumulative update will appear as KB5132061 on Windows 11 24H2, 25H2, or 26H2. Install it, restart when prompted, and the Office update will arrive through the Microsoft 365 update channel or Windows Update, depending on how Office is installed.
For IT teams, the patching order this month should be:
- Outlook first. Apply the Office updates to fix CVE-2026-124194, the exploited zero-day, on every machine running Microsoft 365 Apps or Office LTSC 2021/2024.
- Exchange and domain controllers next. Patch Exchange Server (CVE-2026-116928 and CVE-2026-118207) and domain controllers running LDAP (CVE-2026-119958).
- Schannel and the rest of Windows. Roll out the Windows cumulative update, including the Schannel fix (CVE-2026-119952), to all workstations and servers.
- Check for compromise. If systems were exposed before patching, look for signs of intrusion. The Outlook flaw discloses credentials, so check for unusual logins and rotate any credentials that may have leaked.
Windows 11 23H2 Enterprise and Education users should plan an upgrade now, since KB5131087 is the final update for that version.
Frequently asked questions
What is the November 2026 Patch Tuesday?
It is Microsoft’s monthly security update for November 2026, released on November 10. It fixes 1,093 vulnerabilities across Windows, Office, Exchange Server, and other Microsoft products, including 63 critical flaws and one actively exploited Outlook zero-day.
What is CVE-2026-124194?
CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook. When a user opens a specially crafted message file, Outlook connects to an attacker-controlled server without the usual external-content warning, disclosing the user’s NTLMv2 hash. Microsoft confirms it is being exploited in the wild, and CISA has set a November 24, 2026 remediation deadline for federal agencies.
Can the Outlook zero-day be triggered by the Preview Pane?
No. Microsoft says the Preview Pane is not an attack vector. The victim must open the crafted message file for the flaw to be exploited.
Which Microsoft products does the Outlook zero-day affect?
Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, in both 32-bit and 64-bit editions.
What should I patch first this month?
Patch Outlook first to fix the exploited zero-day, then Exchange Server and domain controllers for the critical Windows Search and LDAP remote code execution flaws (CVE-2026-116928 and CVE-2026-119958), then roll out the Windows cumulative update to everything else.
How many flaws did Microsoft fix in November 2026?
Microsoft fixed 1,093 newly released vulnerabilities, according to Tenable, with 63 rated critical, 1,029 important, and one moderate. SecurityWeek counted 1,094, and the total rises to 1,235 if the 142 Microsoft Edge (Chromium) flaws are included. That is fewer than the 1,411 flaws fixed in October, but the exploited Outlook zero-day makes this month just as urgent.
Related reading: our coverage of the Plex Media Server flaws CISA added to its exploited list in October explains how to check whether a server you run was already exposed before you patched it.