Microsoft released its November 2026 Patch Tuesday security updates on Tuesday, November 10, 2026, fixing 1,093 vulnerabilities, according to Tenable's count. BleepingComputer counts 1,235 flaws, because it also includes Microsoft Edge (Chromium) vulnerabilities — the difference comes from the counting methodology, not from the contents of the update package.
Of the total, 63 flaws are rated critical and 1,029 as important. It is the second month in a row with more than a thousand fixes.
The Outlook zero-day: CVE-2026-124194
The highlight of the month is a spoofing flaw in Microsoft Outlook, tracked as CVE-2026-124194, which Microsoft has marked as already exploited in attacks. The flaw has a CVSS score of 6.5 and a moderate severity rating — but the fact that it is being actively exploited puts it at the top of the priority list.
According to Microsoft's advisory, an unauthenticated attacker can send a specially crafted message file and convince a user to open it in Outlook. Opening the file can cause Outlook to connect to an attacker-controlled network location without showing the usual external-content warning, disclosing the user's NTLMv2 authentication hash. With that hash, the attacker can impersonate the user on other systems.
There are two important details: the attack requires user interaction — the malicious file must be opened — and the Reading Pane (Preview Pane) is not an attack vector, according to Microsoft. The flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities (KEV) catalog on November 10, with a remediation deadline of November 24, 2026 for US federal agencies.
Microsoft credits the discovery to a researcher known as “nono” and to Benoît Sevens. Tenable notes that the advisory also credits the use of Claude, Anthropic's AI model, in discovering the flaw.
Two zero-click critical flaws and a 10.0 score
The release also fixes two critical vulnerabilities rated CVSS 9.8 that require no user interaction: CVE-2026-116928, an out-of-bounds write in the Windows Search component that can lead to remote code execution, and CVE-2026-119958, a similar flaw in Windows' LDAP implementation, exploitable by unauthenticated attackers.
There is also a flaw with the maximum score of 10.0, CVE-2026-109469, in Entra Device Registration. None of these three, however, had known active exploitation at the time of publication.
What to do
The recommendation is to apply the Windows and Office updates as soon as possible, starting with Outlook — the flaw that is already being exploited. For Windows 11, the packages are KB5132061 (versions 24H2, 25H2 and 26H2) and KB5131087 (version 23H2, the last update for the Enterprise and Education editions of that version). In corporate environments, domain controllers and network servers come next after Outlook.
The issue is not isolated: on the same day, Google also fixed a Chrome zero-day already exploited in attacks, as Geekiki reported here.
Sources
- BleepingComputer — Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
- The Register — November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far
- SecurityWeek — Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
- Tenable — Microsoft’s November 2026 Patch Tuesday addresses 1093 CVEs
Image credit: Microsoft Outlook icon (2025–present), via Wikimedia Commons / Microsoft.
Transparency: this article was produced with the help of artificial intelligence, cross-checked against public posts and internet sources, and reviewed based on the original sources cited. We recommend consulting the original sources to confirm the details.
By Muse
