Microsoft’s November 2026 Patch Tuesday: about 1,100 fixes and an Outlook zero-day, and what to patch first

Microsoft's November 2026 Patch Tuesday, released on 10 November, fixed 1,093 vulnerabilities by Krebs on Security's count, including one already being exploited: CVE-2026-124194, an Outlook spoofing flaw that can leak a user's NTLMv2 password hash. It is rated only Moderate, which is why it is easy to under-rate, and it is fixed through Office updates rather than the Windows update.

What was reported

According to Krebs on Security:

• Total: 1,093 vulnerabilities fixed in Windows and supported software.
• Critical: 63, meaning an attacker could take control of a system with little or no user help.
• Privilege escalation: 535 of the flaws.
• Zero-day: one, CVE-2026-124194, in Outlook, already exploited.
• Context: more than 5,100 Microsoft security patches so far in 2026, with more than 1,400 shipped in October.

The Outlook zero-day

CyberSecurityNews describes it as follows. An unauthenticated attacker sends a crafted message file. If the recipient opens it, Outlook connects to an attacker-controlled network location without the usual warning about external content. That can expose the user's NTLMv2 authentication hash, which an attacker may try to crack offline. The Preview Pane is not an attack vector, so the file has to be opened. The report lists 32-bit and 64-bit Office LTSC 2021, Office LTSC 2024 and Microsoft 365 Apps for Enterprise as affected, and says Microsoft does not say who is exploiting it or how widely.

CyberInsider adds that the fix ships through Office security updates, so the Windows cumulative update alone does not address it. SecurityOnline reports that CISA added the flaw to its Known Exploited Vulnerabilities catalog on 10 November with a federal deadline of 24 November. We could not check that on CISA's own site.

Why the counts differ

You will see three totals. Krebs and CyberSecurityNews say 1,093. CyberInsider says 1,094, of which 726 are Windows. A Tech Bytes report attributed to BleepingComputer says 1,235 and shows that its count includes 142 Edge (Chromium) flaws. We could not open the BleepingComputer article itself, so we have not used that figure as our headline. The lesson is to quote a total together with its source, and not to compare months unless the same scope is used. SecurityOnline also notes that Microsoft's total includes CVEs republished for third-party code, such as Chromium and open-source packages.

Other fixes worth knowing

CyberSecurityNews highlights critical remote-code-execution fixes in Exchange Server (CVE-2026-118207), LDAP, Active Directory Domain Services, TCP/IP and the SMB server driver, plus critical bugs in Excel, Word and Outlook. SecurityOnline lists a CVSS 10.0 flaw in Entra Device Registration (CVE-2026-109469), a service Microsoft runs itself, and advises checking the advisory for any steps. CyberInsider also notes that NTLM message signing is now enabled by default for non-anonymous connections, which can affect older apps and devices that still use NTLM.

What it means for businesses

A zero-day with a Moderate score is the kind that gets left until later. Do not leave this one.

• Patch Office first. Make sure Microsoft 365 Apps and any Office LTSC installs are on the November build. A fully patched Windows machine can still be exposed.
• Check how Office updates reach your staff. If Office updates come from a different channel than Windows, confirm it has the fix and see which machines have not restarted Outlook.
• Then patch the servers. Exchange, domain controllers, DNS and DHCP carry the critical remote-code-execution fixes.
• Find where NTLM is still used. Older apps, scanners and file shares often rely on it. With signing now on by default, test the ones you depend on before you need them.
• Warn staff about message files. Tell people not to open unexpected attachments or message files, even if the preview looks harmless.
• Back up and test. Take a backup, patch a few machines, then roll out to the rest.
• Check your Office edition. The affected list includes Office LTSC 2021, which Microsoft's lifecycle page says left support on 13 October 2026. Check Microsoft's Security Update Guide for whether your edition receives this fix, and plan a move to a supported version if it does not.

With around 1,100 fixes in a month and more than 1,400 the month before, patching by hand is hard to keep up with. Our IT support service handles patching, backups and account management, and our guide to what to put in an IT support contract shows what to ask for. We also manage Microsoft 365 for small businesses. Tell us how many PCs and servers you run and we will say what we would patch first.