Last updated: November 11, 2026. This guide is informational and is not affiliated with Microsoft. Vulnerability counts differ between security vendors and Microsoft can revise its advisories after release, so confirm details in the Microsoft Security Update Guide and in Windows Update on your own device.
Microsoft released its November 2026 Patch Tuesday updates on Tuesday, November 10, 2026. The release fixes more than 1,000 security vulnerabilities across Windows, Office, Exchange, SharePoint, SQL Server and developer tools, and it includes one zero-day that Microsoft says was exploited in the wild: an Outlook spoofing flaw tracked as CVE-2026-124194.
If you only do one thing today, open Windows Update and Microsoft 365/Office updates and install what is waiting. The rest of this guide explains what was fixed, who needs to move fastest and what else changed this month.
The Short Answer
- Release date: November 10, 2026 (the second Tuesday of the month).
- Total fixes: about 1,100 CVEs by most counts. Tenable counts 1,093 and SecurityWeek counts 1,094, while BleepingComputer reports 1,235 using a different counting method.
- Critical-rated: 63, according to Tenable’s breakdown (1,029 Important, 1 Moderate).
- Exploited zero-day: CVE-2026-124194, an Outlook spoofing vulnerability that can expose a user’s NTLMv2 hash.
- Windows 10 ESU update: KB5131096 (build 19045.7846).
- End of the line: Microsoft’s release information lists November 10, 2026 as the end-of-updates date for Windows 11 version 23H2 Enterprise and Education editions.
Why the Counts Differ (1,093 vs 1,094 vs 1,235)
Monthly totals depend on what each analyst includes. SecurityWeek notes that Microsoft also republished 165 CVEs from third parties this month and that Chromium-based Edge fixes are listed separately. Some trackers fold those in and others do not, which explains most of the gap. None of the sources we reviewed fully reconciled the 1,235 figure, so treat “roughly 1,100 Microsoft CVEs” as the safest summary.
For context, SecurityWeek reported that October 2026 was even larger (it cited 1,413 vulnerabilities, while BleepingComputer cited 1,411), and that Microsoft has fixed more than 5,000 vulnerabilities so far in 2026. The very large monthly numbers are a recent pattern, not a one-off.
The Outlook Zero-Day: CVE-2026-124194
| Detail | What sources report |
|---|---|
| Product | Microsoft Outlook (Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024) |
| Type | Spoofing |
| Severity / CVSS | Moderate, CVSS 6.5 (per Tenable) |
| Status | Exploited in the wild; Microsoft has not shared details about the attacks |
| Publicly disclosed before the fix? | No, per SecurityWeek |
| Preview Pane | Microsoft says it cannot be triggered through the Preview Pane |
How the attack works
According to SecurityWeek’s summary of the advisory, an attacker sends a specially crafted file. When the victim opens it, Outlook connects to a location the attacker controls without showing the usual external-content warning. That connection can leak the user’s NTLMv2 hash, which attackers can try to crack offline or relay to other services.
The “Moderate” label can be misleading. Credential leaks are often the first step in a larger intrusion, and the fact that real attackers are already using this flaw makes it a priority for any organization running Outlook.
Who found it
Microsoft credits a researcher known as “nono” and Benoît Sevens. Both Tenable and SecurityWeek note that the acknowledgment mentions the use of Anthropic’s Claude AI model in the research, a sign of how AI-assisted vulnerability research is starting to show up in official credits.
Other Critical Fixes Worth Prioritizing
Tenable flagged several critical remote code execution (RCE) bugs that Microsoft rates “Exploitation More Likely.” These are the ones security teams usually patch first on servers:
| CVE | Component | Type | CVSS |
|---|---|---|---|
| CVE-2026-118146 | Windows Active Directory Domain Services | RCE | 8.8 |
| CVE-2026-118207 | Microsoft Exchange Server | RCE | 8.8 |
| CVE-2026-119952 | Windows Schannel | RCE | 8.1 |
| CVE-2026-113862 | Windows NAT | RCE | 8.1 |
| CVE-2026-120002 | SharePoint Server | Elevation of privilege | 9.9 |
Note: Tenable’s write-up lists the SharePoint flaw under its critical items but also describes it as rated Important, so check Microsoft’s advisory for the final rating. Visual Studio Code also received fixes for a security feature bypass (CVE-2026-121663, CVSS 8.8) and an RCE (CVE-2026-121662, CVSS 8.6); VS Code usually updates itself, but confirm under Help > Check for Updates.
What kinds of bugs were fixed
Tenable’s analysis shows elevation of privilege bugs made up 48.9% of the release and remote code execution 27.1%. The products with the most CVEs were Word (65), Excel (64), SQL Server (53), the Windows Advanced Rasterization Platform (37), Windows Installer (36) and the Windows Graphics Kernel (35). SecurityWeek’s per-area split was Windows 726, Office 174, SQL Server 59, developer tools 53, SharePoint 27, Azure 20 and Exchange 9.
Windows 10 ESU: KB5131096
For Windows 10 PCs enrolled in Extended Security Updates, the November update is KB5131096. BleepingComputer reports it moves Windows 10 to build 19045.7846 and Windows 10 Enterprise LTSC 2021 to build 19044.7846. Beyond security fixes, it:
- adjusts daylight saving time rules for Cuba;
- fixes “error 87” when adding a printer published in Active Directory, a bug introduced by the October update;
- fixes a Remote Desktop Intune policy for trusted .rdp publishers and a shadow-connection error on older Windows Server versions;
- applies stricter encoding checks when PowerShell validates script signatures. Scripts with invalid UTF-8 may now fail validation; Microsoft’s fix is to re-save them as UTF-8 with BOM and sign them again;
- is described as fully resolving USB Audio Class 1.0 problems that began with the September 2026 updates.
Not enrolled yet? Our guide to enrolling in Windows 10 Extended Security Updates walks through the options.
Windows 11: What to Expect
Windows 11 versions 24H2, 25H2 and 26H2 receive this month’s security fixes through the regular cumulative update in Windows Update. At the time of writing, Microsoft’s public release-information table had not yet been refreshed with the November KB numbers and build numbers, so we are not listing them here rather than guessing. You can see the exact KB on your PC under Settings > Windows Update > Update history after installing.
Two version notes matter this month:
- Windows 11 23H2 Enterprise and Education: Microsoft’s release information lists November 10, 2026 as the final update date. These devices should move to a newer version as soon as possible.
- Windows 11 24H2 Home and Pro: Microsoft said the October 2026 update was the last for these editions. If your home PC is still on 24H2, see how to install Windows 11 26H2.
If you installed last month’s optional preview, our explainer on the KB5127936 preview update covers what it added; those changes roll into the security update for everyone.
How to Install the November 2026 Updates
Home users
- Save your work and plug in your laptop.
- Open Settings > Windows Update and select Check for updates.
- Install everything listed, then restart when prompted.
- Update Office: open any Office app, go to File > Account > Update Options > Update Now. This is the step that patches the Outlook zero-day.
- Check Update history to confirm the update shows as successfully installed.
IT and small business admins
- Prioritize Outlook/Microsoft 365 Apps across all endpoints because the zero-day is under active attack.
- Patch domain controllers, Exchange and SharePoint servers early, given the critical RCE fixes rated “Exploitation More Likely.”
- Reduce NTLM exposure: consider blocking outbound SMB (TCP 445) to the internet at the firewall and reviewing NTLM restriction policies. These are general hardening steps against hash-leak attacks, not specific instructions from Microsoft’s advisory.
- Test PowerShell signing on Windows 10 ESU machines before broad rollout because of the new encoding validation.
- Plan 23H2 Enterprise/Education upgrades now that servicing has ended.
Frequently Asked Questions
Is the Outlook zero-day dangerous if I only read email in the Preview Pane?
Microsoft says the flaw cannot be triggered through the Preview Pane; the victim has to open the crafted file. Still, install the Office update, since people open attachments every day.
Do I need to do anything if automatic updates are on?
Windows and Microsoft 365 apps usually update on their own, but a restart is often required to finish. Check Update history and restart if a pending update is waiting.
Does this affect Mac or phone versions of Outlook?
The affected products listed in reports are Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 on Windows. Keep every Outlook app updated anyway. Android owners should also review our Android November 2026 security update guide.
When is the next Patch Tuesday?
Patch Tuesday falls on the second Tuesday of each month, which makes the next one December 8, 2026.
Bottom Line
November’s release is huge, but the action list is short: update Office first because of the exploited Outlook flaw, install the Windows cumulative update and restart, and make sure older Windows versions are either enrolled in ESU or upgraded. For a broader look at keeping devices patched, our Android security update guide is the logical next read.
Sources
- Tenable, “Microsoft’s November 2026 Patch Tuesday Addresses 1093 CVEs (CVE-2026-124194),” November 10, 2026.
- SecurityWeek, “Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft,” November 10, 2026.
- BleepingComputer, “Microsoft releases Windows 10 KB5131096 extended security update,” November 10, 2026.
- Microsoft Learn, Windows 11 release information (version and servicing tables).
