November Patch Tuesday: A Record 1,235 Fixes and an Outlook Zero-Day

Microsoft’s November 2026 Patch Tuesday landed on 10 November with 1,235 security fixes, 66 of them rated Critical. One is already being exploited. About half the fixes (639) are in Windows itself.

That total does not include a further 108 fixes released earlier in the month for Edge, Azure Linux (Mariner) and Entra Device Registration.

Patch first: the exploited zero-day

CVE-2026-124194, Microsoft Outlook (spoofing). Microsoft has confirmed attacks in the wild. An attacker sends a crafted message file. If the user opens it, Outlook connects to a server the attacker controls without the usual external-content warning, handing over the user’s NTLM password hash. Those hashes can be cracked offline or relayed to log in elsewhere.

Microsoft rates it only Moderate because the user has to open the file. Do not let the rating set the priority: it is being used now.

Also high on the list

• Office and Excel: 14 Critical remote code execution flaws, 12 of them in Excel. Two more Critical RCEs affect Outlook.
• Servers: Critical fixes for Exchange Server (RCE) and Active Directory Domain Services (RCE and elevation of privilege).
• Microsoft Defender: a Critical remote code execution flaw. Defender usually updates itself, but check the platform version has moved.
• Graphic Fonts: a Critical RCE, the kind that can be triggered by viewing a document or web page.
• Linux too: an OpenSSH authentication bypass (CVE-2026-123158) affects systems using musl libc without PAM, such as Alpine Linux. Check your containers.

The updates to look for are KB5132061 and KB5131087 for Windows 11, and KB5131096 for Windows 10 devices on Extended Security Updates.

Elsewhere this month

Several other vendors have flaws under active attack. If you run any of these, patch them alongside Microsoft:

• Ivanti Connect Secure: two flaws chained in attacks since at least 1 October.
• SonicWall SonicOS: an SSL-VPN authentication bypass.
• Barracuda: two root-level command execution flaws.
• Zyxel GS1900 switches: a zero-day used against nearly 1,000 devices.
• Vates Xen Orchestra: an authentication bypass.
• Google Chrome: the eighth zero-day of the year.

What to do

• Patch Outlook now on every device, then the rest of Office.
• Block outbound SMB (TCP 445) to the internet and add privileged accounts to the Protected Users group. Both limit the damage from NTLM hash theft, this month and next.
• Prioritise Exchange and domain controllers.
• Patch edge devices (VPNs, firewalls, switches) from the list above.
• Check your update reports, not just the policy. Offline, deferred and forgotten devices are where gaps hide.

Cyber Essentials requires high and critical security updates to be installed within 14 days. Two months running above 1,200 fixes shows why that window is a maximum, not a target. Why 14 days is no longer enough.

Bottom line: patch Outlook today, your edge devices this week, and everything else well inside 14 days.

Need to certify? See our remote Cyber Essentials and Cyber Essentials Plus assessments or 📧 contact us.

Source: BleepingComputer, Microsoft November 2026 Patch Tuesday.