Microsoft has released its November 2026 Patch Tuesday updates, fixing a total of 1,094 vulnerabilities across its products. The most notable issue is an exploited zero-day in Outlook, tracked as CVE-2026-124194, which the company describes as a spoofing flaw.
The vulnerability stems from Outlook failing to alert users before performing a potentially dangerous action. An unauthenticated attacker can send a specially crafted message file and convince the victim to open it. Once opened, Outlook connects to an attacker-controlled network location without displaying the standard external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Microsoft notes that the flaw cannot be triggered through the Preview Pane and explicitly states that it discloses a user’s NTLMv2 hash.
The zero-day carries a moderate severity rating and a CVSS score of 6.5. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The advisory credits researchers using the moniker “nono” and Benoît Sevens, with the latter’s acknowledgment noting the use of Anthropic’s Claude AI model.
Windows accounts for 726 of the patched flaws, followed by Office with 174. Additional fixes cover 59 vulnerabilities in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, and nine in Exchange Server. Microsoft also republished 165 CVEs from third parties.
The November release includes critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. It is smaller than October’s record of 1,413 vulnerabilities, bringing Microsoft’s yearly total above 5,000. This month also marks the final security updates for the Enterprise and Education editions of Windows 11 version 23H2.
