November 2026 Patch Tuesday: Outlook Zero-Day Fixed, Update Now
Microsoft’s November 2026 Patch Tuesday fixes 1,094 flaws, including Outlook zero-day CVE-2026-124194, which is already being exploited. Here are the KB numbers and how to update.
Image: TeQBlogs
Microsoft’s November 2026 Patch Tuesday landed on 10 November with fixes for 1,094 security flaws across Windows, Office, Exchange, SharePoint and SQL Server. One of them, an Outlook spoofing bug tracked as CVE-2026-124194, was already being exploited in attacks before the patch came out. If you use Windows 11 or Microsoft 365, install this month’s updates now.
Quick summary
- Release date: 10 November 2026 (late evening in India).
- Size: 1,094 Microsoft CVEs (plus 165 republished third-party CVEs).
- Exploited zero-day: CVE-2026-124194, Microsoft Outlook spoofing, CVSS 6.5, rated Moderate by Microsoft.
- What it does: a crafted message file can leak your NTLMv2 password hash, which attackers can reuse to log in as you.
- Critical bugs: more than 60 rated Critical, including remote code execution in Active Directory, Exchange Server, Schannel and Windows NAT.
- Windows 11 update: KB5132061 (24H2, 25H2 and 26H2), KB5132059 (26H1) and KB5131087 (23H2 Enterprise and Education).
- Action: run Windows Update and Office updates today; IT teams should patch Exchange and domain controllers first.
What is in the November 2026 Patch Tuesday?
Microsoft’s release notes list 1,094 Microsoft CVEs this month, plus 165 republished third-party CVEs. More than 60 are rated Critical. Windows has the biggest share with 726 fixes, followed by Office (174), SQL Server (59), developer tools (53), SharePoint Server (27), Azure (20) and Exchange Server (9).
Most of the fixes are elevation-of-privilege and remote code execution bugs. Only one flaw was marked as exploited, and Microsoft lists none as publicly disclosed before the release.
Also read: DeepMind AlphaProof Code Proves Signal Encryption Is Secure: What It Means
The Outlook zero-day: CVE-2026-124194 explained
CVE-2026-124194 is a spoofing flaw in Microsoft Outlook. Microsoft’s advisory says an attacker can send a specially crafted message file and convince you to open it. When opened, Outlook connects to a network location the attacker controls without showing the usual external-content warning.
That silent connection can expose your NTLMv2 hash. An attacker who captures it can use it to authenticate as you on other systems, which is why a “Moderate” bug can still matter a lot inside an office network.
| Detail | What Microsoft says |
|---|---|
| CVE | CVE-2026-124194 |
| Type | Spoofing (CWE-356: UI does not warn of unsafe action) |
| CVSS 3.1 | 6.5 base, rated Moderate |
| Exploited | Yes, exploitation detected |
| Publicly disclosed | No |
| User interaction | Required: the victim must open the file |
| Preview Pane | Not an attack vector |
| Affected | Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office LTSC 2021 |
The good news is that simply previewing a message in the Reading Pane does not trigger it. The attack needs you to open the malicious file, so be careful with unexpected attachments even after you patch.
Critical bugs IT teams should patch first
Microsoft rates these remote code execution flaws as Critical, with exploitation “more likely”. None was exploited at release, but they affect servers that attackers target often.
| CVE | Component | CVSS 3.1 |
|---|---|---|
| CVE-2026-118146 | Windows Active Directory Domain Services | 8.8 |
| CVE-2026-118207 | Microsoft Exchange Server | 8.8 |
| CVE-2026-119952 | Windows Schannel | 8.1 |
| CVE-2026-113862 | Windows Network Address Translation (NAT) | 8.1 |
If you run on-premises Exchange or domain controllers, test and deploy these updates within days rather than waiting for the next maintenance window. Businesses without an in-house team can also look at managed IT services to keep monthly patching on schedule.
Which Windows update you will get
Windows Update picks the right package for your PC automatically. Use this table to confirm you have it after installing.
| Windows version | Update | OS build after install |
|---|---|---|
| Windows 11 26H2 | KB5132061 | 26300.9974 |
| Windows 11 25H2 | KB5132061 | 26200.9974 |
| Windows 11 24H2 | KB5132061 | 26100.9974 |
| Windows 11 26H1 | KB5132059 | 28000.3501 |
| Windows 11 23H2 (Enterprise, Education) | KB5131087 | 22631.7711 |
| Windows 10 22H2 / 21H2 (ESU and LTSC) | KB5131096 | 19045.7846 / 19044.7846 |
KB5132061 also turns on NTLM message signing by default for non-anonymous connections, which helps reduce NTLM relay attacks, and adds more Secure Boot certificate targeting data. Microsoft says it is not aware of any known issues with this update. Windows 11 23H2 Enterprise and Education reached the end of servicing on the same day, so read our guide on Windows 11 23H2 end of support if you still manage those PCs.
How to install the November 2026 updates
On a Windows PC
- Open Settings and go to Windows Update.
- Click Check for updates.
- Let the cumulative update download and install, then click Restart now.
- After the restart, press Win + R, type winver and check that the build matches the table above.
In Outlook and Microsoft 365 apps
- Open Outlook (or Word or Excel) and click File.
- Select Office Account (or Account).
- Click Update Options, then Update Now.
- Close all Office apps when asked so the update can finish.
Extra steps to stay safe from NTLM hash theft
Patching closes this hole, but a few habits reduce the risk from similar tricks in future.
- Do not open message or Office files you were not expecting, even from known contacts.
- Block outbound SMB (TCP port 445) to the internet at your firewall, a long-standing Microsoft recommendation against hash leaks.
- Use strong, unique passwords and turn on multi-factor authentication for Microsoft 365 accounts.
- Keep your browser updated too; Chrome fixed an exploited zero-day this week, as covered in our Chrome CVE-2026-125350 update guide.
If you want the newest Windows 11 features as well as the fixes, see how to upgrade to Windows 11 26H2.
Frequently asked questions
Is the Outlook zero-day dangerous for home users?
Yes, but the risk is lower than for offices. The attack needs you to open a crafted file, and the leaked NTLMv2 hash is most useful inside company networks. Updating Office removes the risk.
Does the November update fix Outlook automatically?
Microsoft 365 Apps usually update on their own within a few days. To get the fix immediately, go to File, Office Account, Update Options and click Update Now.
What is the Windows 11 November 2026 update number?
It is KB5132061 for Windows 11 24H2, 25H2 and 26H2. Windows 11 26H1 gets KB5132059 and 23H2 Enterprise and Education get KB5131087.
Are there known problems with KB5132061?
At the time of writing, Microsoft says it is not aware of any issues with KB5132061. Back up important files before any big update anyway.
Bottom line
The November 2026 Patch Tuesday is huge, but the urgent part is simple: one Outlook flaw is already under attack. Update Windows and Office today, avoid opening unexpected message files, and if you look after Exchange or Active Directory servers, put the four Critical remote code execution fixes at the top of your list.
Sources
- Microsoft Security Response Center: CVE-2026-124194 Outlook Spoofing Vulnerability
- Microsoft Security Update Guide: November 2026 release notes
- Microsoft Support: KB5132061 (OS Builds 26300.9974, 26200.9974, 26100.9974)
- Microsoft Support: KB5131096 for Windows 10
About The Author
