Microsoft has fixed a critical Windows Search flaw, CVE-2026-116928, scored 9.8 out of 10, that attackers can trigger without the victim opening an email or clicking a link. The flaw was patched on 10 November 2026 as part of Microsoft's November Patch Tuesday.

The attack works through email. According to Microsoft's guidance, an attacker sends an email carrying a specially crafted attachment, and Exchange Server processes that attachment automatically when it indexes it for search. The recipient does not need to open the message at all, which is what makes this flaw so dangerous for organisations that run Exchange. Microsoft rates the flaw as critical and has assessed exploitation as less likely for now, but it has not been marked as exploited.

What to patch first

The fix ships in the normal November cumulative update for every supported Windows and Windows Server version, including update KB5132061 for Windows 11 versions 24H2, 25H2 and 26H2. Administrators should apply the update promptly, with mail and Exchange servers at the front of the queue, and then work through the rest of the estate. Microsoft's November release fixed 1,093 flaws in total, but only one, the Outlook spoofing flaw CVE-2026-124194, was marked as actively exploited.

Organisations that cannot patch immediately should limit exposure of Exchange and search services where possible and watch for unusual activity on mail servers. The key point is that no user action is needed for this attack, so awareness training alone will not stop it. Only the patch closes the hole. iFynx and Action1 both list CVE-2026-116928 among the November flaws to prioritise.