MeridianMeridian

Microsoft Releases November 2026 Patch Tuesday Updates KB5132061 and KB5131087 for Windows 11

Microsoft has issued the November 2026 Patch Tuesday cumulative updates KB5132061 and KB5131087 for Windows 11 versions 26H2, 25H2, 24H2, and 23H2. The updates deliver security patches for hundreds of vulnerabilities along with numerous bug fixes and new features. Key improvements include a faster and more customizable context menu in File Explorer, modernized AutoPlay dialogs, expanded memory integrity protection, and IPv6 CLAT networking support. New recovery capabilities such as Cloud rebuild and enhanced WinRE Wi-Fi handling have also been added. The release further improves accessibility tools including Narrator math equation support and Magnifier per-monitor zoom. No new issues were reported with this month's updates.

BleepingComputerTranslated from English

Read at source

Microsoft has released the Patch Tuesday Windows 11 KB5132061 and KB5131087 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs and add new features.

Today's updates are mandatory as they contain the November 2026 Patch Tuesday security patches for hundreds of vulnerabilities discovered in previous months. You can install today's update by going to Start > Settings > Windows Update and clicking on 'Check for Updates.' You can also manually download and install the update from the Microsoft Update Catalog.

This is the eleventh 'Patch Tuesday' release in 2026, and it's based on 24H2, which means 25H2 or 26H2 get the same update. There are no exclusive or special changes. You'll get the same fixes across the two versions of Windows 11.

What's new in the November 2026 Patch Tuesday update

With today's update, Microsoft is adding new customization options to Windows 11 and fixing minor issues with File Explorer. Here's the full list of improvements and fixes:

[Context menu in File Explorer] New! This update introduces an updated context menu that is faster, simpler, and more customizable. The updated menu opens more quickly, reduces clutter, and gives you more control over the commands and app extensions that appear when you right-click.

[Modernized AutoPlay experience] New! This update modernizes the AutoPlay dialog that appears when you connect devices such as a phone, camera, or removable drive to your PC.

[File Explorer] New! Key file information, such as name, location, and date, now appear in a consistent layout on the File Explorer search results page. New! Address bar now supports ~, making it quicker to navigate directly to your user profile folder and subfolders. New! This update enables dark mode support in the Folder Options dialog in File Explorer.

[XBOX mode] New! This update introduces a refreshed Gaming Task View experience in XBOX mode, featuring a new navigation bar that provides quick access to Exit to Desktop and Power Options.

[Settings] New! This update improves the Privacy & security page in Windows Settings by grouping related Camera, Microphone, and Location privacy controls. New! The Device Info card on the Settings Home page is expanding to additional markets.

[Phone Link] New! You can now hover over a recent message or notification in the Recent section to preview its content directly in Start without opening the item.

[Taskbar] New! The update improves animations of app window previews when mousing across app icons in the taskbar and improves the underlying state persistence of taskbar settings related to multiple monitors.

[Magnifier] New! Magnifier now includes a contrast theme toggle and supports per-monitor zoom and viewport locking for multi-monitor setups.

[Live Captions] New! This update improves Live Captions with a new Include screen reader audio setting.

[Narrator] New! Narrator now supports reading and navigating math equations in supported Microsoft 365 apps and web content in Microsoft Edge and Google Chrome.

[Family Safety] New! The update improves family safety messaging when applications are blocked because of age-restricted parental controls.

[Recovery] New! This update enables Windows recovery (WinRE) to automatically reuse eligible Wi-Fi profiles already saved in Windows.

[Cloud rebuild] New! This update introduces Cloud rebuild, a new recovery option that reinstalls Windows 11 using a Windows image and device drivers downloaded from Windows Update.

[Windows settings backup and restore] New! This update introduces a Restore Summary that appears after you restore a backup profile to a new device.

[Adaptive hibernate policy] New! This update improves the adaptive hibernate policy to provide more instant-on resumes from Modern Standby while helping preserve battery life.

[Security] New! This update expands memory integrity protection across eligible devices.

[Windows IPv6 networking support] New! Windows now supports IPv6 CLAT for Wi-Fi and Ethernet network interfaces.

[Data Protection API (DPAPI)] New! This update adds a warning before prompt-based protect and unprotect operations.

[Windows Spotlight] This update makes underlying platform changes to generally improve Windows Spotlight reliability on the lock screen.

[Unicode] This update provides Windows text shaping support for Unicode 17.0, helping Windows correctly display and shape newly encoded characters and scripts.

Microsoft is not aware of any new issues with this month's Patch Tuesday, and it also patched a long-standing issue that broke USB audio on some PCs.

MicrosoftWinREUnicode 17.0
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

SGLang RCE Exploit Breaches NEAR AI Inference Servers, Exposing Data from 18 Agents and 100 Users
Vulns & Exploits

SGLang RCE Exploit Breaches NEAR AI Inference Servers, Exposing Data from 18 Agents and 100 Users

An attacker exploited a remote code execution vulnerability in SGLang, an open-source inference engine, to compromise one of NEAR AI's inference servers last Sunday. The intrusion allowed access to requests processed that day, including those handled in confidential mode inside a trusted execution environment. Although the TEE was intended to protect privacy, the flaw in SGLang running inside it enabled the attacker to reach sensitive data. The intruder then moved laterally to an internal system behind the deprecated Private Chat product, downloading account details for roughly 100 users. Eighteen AI agents on an older NEAR AI Agents deployment outside the TEE were also compromised, resulting in the theft of chat histories, settings, and logs. Two NEAR AI Cloud API keys were exposed in logs and subsequently revoked. NEAR AI has since revoked sessions, replaced tokens, deployed a SGLang fix across servers, and completed forensic review while notifying affected users.

The Hacker NewsNov 10, 2026Translated from English

Git Patches Integer Truncation Flaw CVE-2026-111760 Enabling Code Execution via Malicious Submodules in Recursive Clones
Vulns & Exploits

Git Patches Integer Truncation Flaw CVE-2026-111760 Enabling Code Execution via Malicious Submodules in Recursive Clones

The Git project has released fixes for CVE-2026-111760, an integer truncation vulnerability in Git's index handling that allows a malicious repository to execute attacker-controlled code during recursive clones involving submodules. The flaw affects multiple Git versions and was addressed in Git 2.56.1 along with backported updates for the 2.50 through 2.55 series. An extremely long path can bypass safety checks and be truncated to target a .git file, which Git treats as a symlink in freshly cloned submodules, enabling malicious hooks to run. GitHub has applied the fixes to its platform and recommends immediate updates, while also detailing five additional vulnerabilities resolved in the same releases. GitLab highlighted risks to code-hosting servers through commands like git merge-tree. Workarounds include avoiding untrusted recursive clones and sources until patches are installed.

The Hacker NewsNov 10, 2026Translated from English

Microsoft Patches 1,094 Vulnerabilities Including Exploited Outlook Zero-Day CVE-2026-124194
Vulns & Exploits

Microsoft Patches 1,094 Vulnerabilities Including Exploited Outlook Zero-Day CVE-2026-124194

Microsoft’s November 2026 Patch Tuesday release addresses a total of 1,094 vulnerabilities across its product portfolio. Among them is CVE-2026-124194, an Outlook spoofing zero-day that has already been exploited in the wild. The flaw allows an attacker to send a specially crafted message file that tricks users into opening it, causing Outlook to connect to an attacker-controlled server and disclose NTLMv2 hashes without showing the usual external-content warning. Microsoft rates the issue as moderate with a CVSS score of 6.5 and confirms it cannot be triggered through the Preview Pane. The update also covers 726 Windows flaws, 174 Office issues, and dozens more in SQL Server, SharePoint, Azure, and Exchange Server. This release marks the final monthly security updates for Windows 11 version 23H2 Enterprise and Education editions.

SecurityWeekNov 10, 2026Translated from English