Microsoft has released its November 2026 Patch Tuesday update, fixing 1,235 security flaws across its products, according to BleepingComputer's count. It is the second-largest monthly update Microsoft has shipped, and the fourth record month this year, after July, September and October.

Of the flaws fixed, 66 are rated critical. Most are elevation-of-privilege flaws (536), followed by remote code execution (296) and information disclosure (157). Other trackers differ: SecurityAffairs, using Zero Day Initiative figures, puts new vulnerabilities at about 1,090.

The exploited Outlook zero-day

The most urgent flaw is CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook that Microsoft says is already being exploited. An attacker sends a specially crafted message file and persuades the user to open it. Outlook then connects to a network location controlled by the attacker without the usual external-content warning, disclosing the user's NTLMv2 hash. Microsoft rates the flaw Moderate, with a CVSS score of 6.5. It affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 10 November, giving US federal agencies until 24 November to apply the fix.

Critical flaws to patch first

Also prioritise CVE-2026-116928, a Windows Search remote code execution flaw scored 9.8 that can trigger without any click when Exchange indexes a crafted email attachment, and CVE-2026-119958, a Windows LDAP flaw that can run code on domain controllers. CVE-2026-119952, a Schannel flaw, is marked "Exploitation More Likely". The Zero Day Initiative counts 30 wormable flaws in this release.

What to do now

Apply the Microsoft 365 or Office update to Outlook users first, starting with administrators and high-value accounts, then install the Windows updates. Deploy quickly, especially for network-facing services such as DNS, DHCP, LDAP and Exchange.

Sources: Infosecurity Magazine and SecurityAffairs.