Microsoft November 2026 Patch Tuesday: Outlook Zero-Day

Microsoft’s November 2026 security release, published on November 10, fixes more than a thousand vulnerabilities, and one of them is already being used in attacks. The important one for most people is CVE-2026-124194, a Microsoft Outlook flaw that can leak the authentication hash tied to your Windows account.

Microsoft rates it “moderate” with a CVSS score of 6.5, which undersells the practical risk. The US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on November 10, with a remediation deadline of November 24, 2026 for federal agencies.

What the Outlook flaw actually does

According to Microsoft’s advisory, an unauthenticated attacker sends a specially crafted message file and persuades the recipient to open it. Outlook then connects to an attacker-controlled network location without showing its usual external-content warning. In the process it discloses the user’s NTLMv2 hash, which the attacker can use to authenticate as that user.

Two details matter:

The preview pane is not an attack vector. The message file has to be opened.
Affected products are Office, not Windows alone. Microsoft lists Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Patching Windows and skipping Office leaves the hole open.

NTLMv2 hashes are not passwords, but they are usable credentials in many networks. An attacker who captures one can attempt relay attacks against other systems that still accept NTLM authentication, which is why security teams treat this class of bug as more serious than the score suggests.

The numbers, and why they disagree

Different trackers published different totals for this month’s release: Krebs on Security reported 1,093 vulnerabilities with 63 rated critical, BleepingComputer reported 1,235, and The Hacker News reported 1,259. The gap is not a contradiction so much as a counting problem: outlets include or exclude non-Microsoft CVEs, Edge updates and advisories differently, and Microsoft’s own release notes are the authority.

What is consistent across all three: this is the second consecutive month above 1,000 flaws, Windows accounts for the largest share, and there is exactly one flaw confirmed as exploited in the wild this month.

How to check that you are patched

Update Office separately from Windows. Open any Office app, go to File, then Account (it may read Office Account in Outlook), choose Update Options and then Update Now. If the controls are greyed out on a work machine, your IT department manages updates and you should ask them rather than assume.
Run Windows Update. On Windows 11 versions 24H2, 25H2 and 26H2, the November cumulative update is KB5132061. Check Settings, then Windows Update, then Update history to confirm it installed.
Update your browser. Chrome 157.0.8103.50 fixes nine holes including CVE-2026-125350, a use-after-free in Chromium’s XML component that CISA also added to its exploited list with the same November 24 deadline. Edge and other Chromium browsers need the equivalent update.
Restart. Office and Windows updates frequently finish only after a restart, and a pending restart means the flaw is still live.

The rest of the November release

Beyond Outlook, the release includes a SharePoint incorrect-authorisation flaw rated 9.9, a Windows LDAP out-of-bounds write rated 9.8 and an Active Directory Domain Services remote code execution bug rated 8.8, among hundreds of elevation-of-privilege fixes. Exchange Server also received updates; Microsoft’s Exchange team publishes separate deployment guidance.

If you want the pattern from last month, our piece on Microsoft’s record October patch release explains why the counts keep climbing, and the Windows 11 November 2026 feature update covers what changed outside security.

What we did not do

We did not test the exploit, and we have no information about who is being targeted beyond Microsoft’s statement that the flaw was exploited before the fix shipped. The technical description, affected products and CVSS score come from Microsoft’s advisory; the deadlines come from CISA’s KEV catalog. Totals differ between outlets and we have reported that disagreement rather than picking a number.