MicrosoftAvailable
AZ-800 / AZ-801
November 2026 Patch Tuesday: 1,235 Flaws, Outlook Zero-Day
Microsoft's November 2026 Patch Tuesday fixes a record 1,235 flaws and one actively exploited Outlook zero-day, CVE-2026-124194. Here is what to patch, check and harden first.
Short answer: Microsoft fixed 1,235 flaws on November 10, 2026, including CVE-2026-124194, an Outlook spoofing zero-day exploited to steal NTLM hashes. Install the November Windows updates, confirm your Outlook build against Microsoft's advisory, and limit outbound NTLM and SMB traffic.
Microsoft's November 2026 Patch Tuesday fixes a record 1,235 flaws, including one Outlook zero-day that attackers already exploit. Install this month's Windows updates now, and check your Outlook build against Microsoft's advisory for CVE-2026-124194.
BleepingComputer reported the release on November 10, 2026. Here is what matters and what to do.
What Microsoft released this month
This Patch Tuesday addresses 66 Critical vulnerabilities. Of those, 48 are Remote Code Execution (RCE), 15 are Elevation of Privilege (EoP), and three are Use-After-Free bugs in Microsoft Edge. About 639 of the 1,235 flaws sit in Windows or Windows components.
The total counts only flaws released on Patch Tuesday itself. It leaves out 108 flaws fixed earlier this month: one Entra Device Registration, 82 Mariner, and 25 Microsoft Edge flaws.
October set the previous record with 1,411 flaws. The report notes that Microsoft continues to use AI to find and patch vulnerabilities.
The Windows updates tied to this release are:
Windows 11:
KB5132061andKB5131087cumulative updatesWindows 10:
KB5131096extended security update
Flaw counts by category
The numbers below are approximate, as listed in the report.
Category | Approx. flaws |
|---|---|
Elevation of Privilege | 536 |
Remote Code Execution | 296 |
Information Disclosure | 157 |
Microsoft Edge (Chromium-based) | 142 |
Denial of Service | 46 |
Security Feature Bypass | 27 |
Spoofing | 22 |
A big count does not mean 1,235 emergencies. Only one flaw is confirmed as exploited. Start there, then work through the Critical RCE and EoP fixes.
How the Outlook zero-day works
The exploited flaw is CVE-2026-124194, a Microsoft Outlook Spoofing vulnerability. Attackers used it to steal NTLM account hashes. We cover it in more detail in our CVE-2026-124194 patch guide.
Microsoft describes the attack this way: "An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook." Opening the file could make Outlook connect to an attacker-controlled network location without the usual external-content warning.
Windows may then try to authenticate to that remote server. That exposes the user's NTLMv2 hash. The attacker can capture it and potentially crack it offline, then use the credentials to reach corporate accounts.
Microsoft calls a flaw a zero-day when it is publicly disclosed or actively exploited with no official fix available. Exploitation needs network connectivity and user interaction. Similar bugs have been exploited before, typically through malicious attachments in phishing campaigns.
The exact fixed Outlook build is listed in Microsoft's Security Update Guide entry for CVE-2026-124194, so confirm it there.
Patch and verify today
Start with the exploited flaw, then roll out the Windows updates in your normal rings.
Install the November Windows updates listed above.
Update Outlook and compare the build with the fixed build in Microsoft's advisory.
Restart machines that need it, then verify.
Check whether a PC has this month's Windows updates:
Get-HotFix | Where-Object { $_.HotFixID -in 'KB5132061','KB5131087','KB5131096' } | Select-Object HotFixID, InstalledOnRead the installed Outlook build:
$p = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE').'(default)'
(Get-Item $p).VersionInfo.FileVersionRun these through your management tool across all endpoints. Flag any machine that returns nothing or an older build.
Cut NTLM exposure while you roll out
The attack needs the PC to reach an attacker's server. You can limit that even before every machine is patched. These steps are general hardening, not Microsoft's official workaround for this CVE, so test them first.
Block outbound SMB to the internet at your perimeter firewall. On a single Windows PC, you can add a host rule:
New-NetFirewallRule -DisplayName "Block outbound SMB to internet" -Direction Outbound -Protocol TCP -RemotePort 445 -RemoteAddress Internet -Action BlockNext, audit outgoing NTLM before you restrict it. Setting this value to 1 audits all outgoing NTLM traffic:
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' -Name 'RestrictSendingNTLMTraffic' -Type DWord -Value 1Then look for the audit events:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-NTLM/Operational'; Id=8001} -MaxEvents 50 | Select-Object TimeCreated, MessageIf you see NTLM connections to unfamiliar external addresses, treat that user as possibly exposed. Reset the password and review recent sign-ins.
A worked example: triaging a small office
Say you manage 40 Windows PCs and everyone uses Outlook. A sensible order looks like this:
Run the
Get-HotFixcheck on all PCs and list the ones missing updates.Patch Outlook first on staff who handle outside email, such as finance and support.
Block outbound port 445 at the firewall the same day.
Turn on NTLM auditing and review event 8001 after a few days.
Warn users not to open unexpected message files, even from known senders.
This order puts the exploited bug and its network path ahead of the other fixes.
Other vendors also shipped fixes
Patch Tuesday was not the only urgent news this month. Cisco, Ivanti, SonicWall, Zyxel and SAP all released security updates, and Google patched another exploited Chrome zero-day. N-able also took hosted N-central environments offline, which we cover in our N-able write-up. If you run those products, check their advisories this week.
What IT and security learners can take from this
This release shows why patch triage is a core skill. You rank flaws by exploitation, exposure and impact, not by raw count. It also shows how a small feature, like an external-content warning, can protect credentials. Learners aiming at identity and platform security can practice these ideas for the AZ-500 Azure Security Engineer exam, and our cybersecurity certification page lists more options.
Sources
Questions about this topic
Does the Outlook zero-day work without the user doing anything?
No. Microsoft says exploitation requires user interaction. The user must open a specially crafted message file in an affected version of Outlook. Training users to avoid unexpected message files still helps.
What is an NTLM hash, and why would an attacker want it?
An NTLM hash is the scrambled form of a password that Windows sends during authentication. If an attacker captures an NTLMv2 hash, they can try to crack it offline. A cracked hash gives them the password, which they can use to reach corporate accounts.
Why did this month's count exclude 108 flaws?
BleepingComputer counts only vulnerabilities Microsoft released on Patch Tuesday itself. The 108 flaws were fixed earlier in the month: one Entra Device Registration, 82 Mariner, and 25 Microsoft Edge flaws. Those still count as fixed, just not in the 1,235 total.
Which Windows updates should I look for?
For Windows 11, look for KB5132061 and KB5131087 cumulative updates. For Windows 10, the extended security update is KB5131096. The Get-HotFix command in this article checks for all three.
What should I do if I think a user's hash was captured?
Reset that user's password and review their recent sign-ins. Check NTLM audit events for outgoing connections to unfamiliar external addresses. Then confirm Outlook and Windows are updated on their PC.
