Microsoft November 2026 Patch Tuesday Outlook Zero Day Explained: 1,094 Fixes and What to Patch First

Image: Microsoft logo for identification — this post covers Microsoft's November 2026 security updates. Image: Wikimedia Commons, Microsoft, public domain (text logo).

TL;DR: The Microsoft November 2026 Patch Tuesday outlook zero day explained in one line: Microsoft fixed 1,094 flaws on 10 November 2026, and one of them — an Outlook spoofing bug, CVE-2026-124194 — was already being exploited to steal users' login hashes. Patch Outlook first, then your Exchange servers and domain controllers, before the 24 November deadline.

Key Highlights

• Microsoft released its November 2026 security updates on 10 November 2026, fixing 1,094 Microsoft-assigned flaws, 63 of them rated Critical — the second month in a row above 1,000.
• One flaw is already being exploited: CVE-2026-124194, a Moderate-rated Outlook spoofing bug (CVSS 6.5) that can leak a user's NTLMv2 hash when a crafted message file is opened.
• CISA added the Outlook flaw to its Known Exploited Vulnerabilities catalog on 10 November, with US federal agencies ordered to patch by 24 November 2026.
• The release also includes a zero-click Windows Search flaw reachable through Exchange (CVE-2026-116928, CVSS 9.8) and remote code execution flaws in LDAP and Schannel — and researchers count 30 potentially wormable bugs.
• Counts differ between trackers (1,094, 1,235 and 1,259) because they count different things — the article explains why, so you can stop worrying about which number is "right".

What happened in the Microsoft November 2026 Patch Tuesday?

Microsoft published its November 2026 security updates on Tuesday 10 November 2026, the second Tuesday of the month, as it does every month. According to Microsoft's release notes, as reported by SecurityWeek and The Record, the release addresses 1,094 vulnerabilities Microsoft assigned itself, 63 of them rated Critical. The Hacker News counts 1,259 flaws in total, including 165 CVE identifiers issued by other vendors, while BleepingComputer counts 1,235, including 142 flaws in the Chromium-based Microsoft Edge. The numbers disagree because each tracker draws the line differently — not because any of them is wrong. The figure that matters for most readers is the one from Microsoft's own release notes: 1,094, of which 63 are Critical.

The volume is no longer unusual. October's Patch Tuesday fixed a record 1,411 flaws, and Microsoft has now fixed more than 5,100 CVEs in 2026 alone, according to Tenable. The company uses AI to find vulnerabilities faster, which is part of why the monthly totals have ballooned — and part of why the exploited flaw, rather than the total, is what should drive your patching order.

Microsoft November 2026 Patch Tuesday outlook zero day explained: how the Outlook flaw works

The one flaw Microsoft says attackers are already using is CVE-2026-124194, titled "Microsoft Outlook Spoofing Vulnerability". Microsoft rates it only Moderate, with a CVSS score of 6.5, and that label undersells it. The flaw is in how Outlook handles unsafe actions: an unauthenticated attacker sends a specially crafted message file and persuades the recipient to open it. Outlook then connects to an attacker-controlled network location without showing its usual external-content warning, and that connection can disclose the user's NTLMv2 hash — the credential Windows uses to authenticate on a network. An attacker who captures the hash can use it to impersonate the user, read their data and move to other systems they can reach.

Three details matter. First, exploitation needs the user to open the file — the Preview Pane is explicitly not an attack vector, according to Microsoft. Second, Microsoft has not attributed the attacks to any threat actor and has published no technical details of how the flaw is being exploited in the wild. Third, the discovery is credited to a researcher identified as "nono" and to Anthropic's Benoît Sevens, who used Claude to find it. The flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in 32-bit and 64-bit. The fixed builds are 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024.

CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on 10 November 2026, the same day the patches shipped, requiring US federal agencies to apply the fix by 24 November 2026. It was one of six flaws CISA added that day; the others include a Chrome use-after-free flaw (CVE-2026-125350, CVSS 8.8), a Cisco BroadWorks flaw, two Barracuda flaws and an Openwave Messaging flaw. The 24 November date is a federal deadline, not a deadline for everyone — but when CISA puts a flaw on this list, it is the clearest available signal that the bug is being used in real attacks, and home and business users should treat it the same way.

The other flaws to patch next

Once Outlook is fixed, the next tier is the network-facing remote code execution flaws, because several need no login at all. The table below is the patching order security researchers recommend.

CVE	Component	Severity	Why it matters
CVE-2026-124194	Outlook	Moderate, 6.5	Actively exploited; leaks NTLMv2 hash. Patch first.
CVE-2026-116928	Windows Search via Exchange	Critical, 9.8	Zero-click: a crafted attachment triggers when the server indexes it. No user action needed.
CVE-2026-119958	Windows LDAP	Critical	Unauthenticated remote code execution; dangerous on domain controllers.
CVE-2026-119952	Windows Schannel	Critical	Marked "Exploitation More Likely" by Microsoft.
CVE-2026-95962	Windows Virtual Filtering Platform	Critical	Use-after-free reachable with a crafted network packet; no login or user action.
CVE-2026-112967	Xbox Live Networking Service	Critical, 9.8	Heap overflow; researchers rate exploitation unlikely.
CVE-2026-125350	Google Chrome (XML)	High, 8.8	Also in CISA's KEV list on 10 November; update Chrome too.

The Windows Search flaw deserves a closer look. CVE-2026-116928 is a remote code execution bug reached through Exchange Server: an unauthenticated attacker emails a crafted attachment, and the flaw triggers when the server indexes it automatically, so the recipient never opens anything. It scores CVSS 9.8, and the Zero Day Initiative rates it more severe than any of the nine patches Exchange received this month. The LDAP flaw, CVE-2026-119958, lets an unauthenticated attacker send crafted LDAP calls over the network, trigger an out-of-bounds write and run code in the service context — which could be destructive on a domain controller.

Illustrative image: the Windows 11 logo — the November updates cover Windows 11, Windows 10, Office, Exchange and Azure. Image: Wikimedia Commons, Microsoft, public domain (text logo).

The Zero Day Initiative counts 30 potentially wormable bugs in this month's release, down from 59 in October. Seventeen carry advisory wording about an unauthenticated attacker running code over the network with no interaction, spread across Message Queuing, DNS, DHCP Server, LDAP, Exchange, Schannel and other network-facing services. The Initiative itself warns it may be wrong on some, because a few advisories are light on detail — but its advice is unambiguous: test and deploy quickly, starting with network-facing services.

Why the flaw counts differ between sources

Readers who check more than one report will see 1,090, 1,093, 1,094, 1,235 and 1,259 for the same release. None of these is a mistake; each counts a different set. Microsoft's release notes list 1,094 Microsoft-assigned CVEs; severity ratings cover 1,093 of them, which is where the 1,093 figure comes from. The Zero Day Initiative counts about 1,090 new CVEs. BleepingComputer's 1,235 adds 142 flaws in the Chromium-based Microsoft Edge. The Hacker News' 1,259 adds 165 CVE identifiers issued by other vendors and republished by Microsoft. For a home user, the practical total is the 1,094 Microsoft flaws plus the Edge and Chrome updates your browser already handles separately. What matters is not the total but the one exploited flaw and the handful of critical network flaws — which is why this article leads with those instead of the headline number.

Why it matters for readers in India

Outlook is the default email client in most Indian offices, and Windows runs on the overwhelming majority of business desktops, so this is not a flaw that affects someone else's network. The attack needs only one opened file, and the stolen hash can be used to sign in as the victim — which is why security researchers keep saying the Moderate rating undersells it. Indian IT teams should treat the Outlook update as the first install of the month, before the larger Windows cumulative updates, and should check that Office updates are actually deploying: the Outlook fix ships through the Office security updates, so installing the Windows cumulative update alone does not fix it.

For home users the risk is smaller but real. The same crafted file can arrive in a personal inbox, and a home PC on the same network as a work laptop can be a stepping stone. The fix is the same in both cases: install the November updates, restart, and check that Office has updated too. There is no India-specific advisory from CERT-In cited in the sources for this release, so this article does not claim one exists — the CISA deadline and Microsoft's own exploitation flag are the operative warnings.

How to update now

On Windows 11, go to Settings, then Windows Update, and install the November cumulative update — KB5132061 for versions 26H2, 25H2 and 24H2, which takes them to builds 26300.9974, 26200.9974 and 26100.9974 respectively. Version 23H2 takes KB5131087, which is also the last update for 23H2 Enterprise and Education editions, so anyone still on 23H2 should plan the move to a supported version now. Then update Office: in any Office app, go to File, then Account, then Update Options, and choose Update Now. Restart the PC when prompted. Microsoft lists no known issues for either Windows 11 package at release, and the next scheduled Patch Tuesday is 8 December 2026.

Should you care? Patch now or wait?

Verdict: ✅ Patch now — start with Outlook. One flaw in this release is already being exploited, and it needs only a single opened file to steal a login hash. Install the Office update first, then the Windows cumulative update, then the Exchange and domain-controller updates. Waiting for the December Patch Tuesday leaves the exploited flaw open for another month, and there is no workaround listed for it.

FAQs

What is CVE-2026-124194?
CVE-2026-124194 is a spoofing flaw in Microsoft Outlook, rated Moderate with a CVSS score of 6.5. When a user opens a specially crafted message file, Outlook can connect to an attacker-controlled location without its usual external-content warning, disclosing the user's NTLMv2 hash, which an attacker can use to impersonate them.

Is the Outlook zero-day being exploited?
Yes. Microsoft marks CVE-2026-124194 as "Exploitation Detected" in its Security Update Guide, and CISA added it to its Known Exploited Vulnerabilities catalog on 10 November 2026. Microsoft has not named a threat actor or published details of the attacks.

How many flaws did Microsoft fix in November 2026?
Microsoft's release notes list 1,094 Microsoft-assigned flaws, 63 of them Critical. Other trackers report higher totals because they count differently: BleepingComputer's 1,235 includes 142 Microsoft Edge flaws, and The Hacker News' 1,259 includes 165 non-Microsoft CVE identifiers.

Do I need to update if I only use Outlook on the web?
The flaw affects Outlook desktop in Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Outlook on the web is not listed as affected, but the Windows, Exchange and Chrome flaws in the same release still apply to most users, so the November updates are worth installing regardless.

Takeaway

November's Patch Tuesday is the second 1,000-plus month in a row, but the size of the release is not the story — the one exploited Outlook flaw is. Patch Outlook first, then Exchange and your domain controllers, and do it before 24 November.

For the wider November patch picture, our SAP November 2026 Patch Day explainer covers the four CVSS 10.0 flaws SAP fixed the same week, and our CISA KEV November 2026 explainer covers the four exploited flaws CISA ordered patched by 12 November — this month's list keeps growing, so check your updates now.

Sources

• Microsoft Security Response Center — November 2026 Security Updates (release notes)
• CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-124194 added 10 November 2026, due 24 November 2026)
• The Hacker News — Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes (11 November 2026)
• BleepingComputer — Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day (10 November 2026)
• Security Affairs — Microsoft November Patch Tuesday: one exploited Outlook bug and 30 wormable flaws (11 November 2026)