Patch Tuesday is the name for Microsoft's regular monthly release of security fixes, published on the second Tuesday of each month. The November 2026 release arrived on Tuesday 10 November, and it matters more than most: it fixes more than 1,000 flaws across Microsoft's software, including one in Microsoft Outlook that Microsoft says attackers are already exploiting. If you use Windows or Outlook, this is the update to install first.

The release is the second month in a row in which Microsoft's patch volume has passed 1,000 flaws. The exact total depends on how the flaws are counted: Security Affairs reports about 1,090 Microsoft-issued vulnerabilities, while The Hacker News counts 1,259, a figure that includes 165 CVE identifiers issued outside Microsoft. Either way, it is another very large month, and the exploited Outlook flaw is the one to fix first.

What was in the November 2026 release?

The fixes span Windows and its components, Office, networking and remote access, graphics, media and printing, storage and file systems, .NET and Visual Studio, security and identity, Azure and cloud, Exchange Server, Dynamics and Xbox. The Hacker News breaks the total down as 726 flaws in Windows, 174 in Office, 61 in developer tools, 59 in SQL Server and 27 in SharePoint Server. More than 500 of the flaws relate to elevation of privilege, followed by remote code execution and information disclosure bugs.

According to Tenable, cited by The Hacker News, Microsoft has now addressed more than 5,100 CVEs — publicly disclosed vulnerabilities — in 2026 alone. The Zero Day Initiative counts 30 potentially wormable bugs in this month's release, down from 59 last month. A wormable flaw is one an attacker could use to spread from machine to machine over a network without the victim doing anything, which is why security teams treat them as urgent even when they are not yet being exploited.

What is CVE-2026-124194, the exploited Outlook flaw?

CVE-2026-124194 is a spoofing flaw in Microsoft Outlook, and it is the only vulnerability in this month's release that Microsoft says is already being exploited. Its CVSS severity score is only 6.5 out of 10, which understates the practical risk: exploitation is already happening, it needs only one click, and Outlook is used by almost every organisation.

An unauthenticated attacker sends a specially crafted message file and persuades the victim to open it in an affected version of Outlook. Opening the file can cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information — an NTLMv2 hash — that could be used to impersonate the user. An NTLMv2 hash is a cryptographic response Windows uses to prove a user's identity without sending their password; if an attacker captures it, they can sign in as the victim, read their data and move to other systems the victim can reach.

Exploitation requires network connectivity and user interaction: somebody has to open the malicious file. The Preview Pane is not an attack path. Microsoft credited a researcher known as Nono and Anthropic's Benoît Sevens, who reported the flaw with the help of the AI assistant Claude, with discovering it. Microsoft has not attributed the exploitation to any particular threat actor and has not published technical details of how the flaw is being used in the wild.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-124194 to its Known Exploited Vulnerabilities catalogue, requiring US federal agencies to apply the fix by 24 November 2026. That deadline is a useful guide for everyone else too: patch Outlook first.

Which other flaws should IT teams prioritise?

Beyond the exploited Outlook bug, several flaws stand out for their severity or for needing no user interaction at all.

Security researchers quoted in the coverage advise the same order of work: fix what is already being exploited first, then what is exposed to the internet, then everything else. Network-facing services such as DNS, DHCP, LDAP and Exchange deserve the earliest attention.

What should you do?

For home users, the advice is simple: install the November Windows and Office updates as soon as they are offered, and do not open unexpected message files or attachments, even from senders you recognise. A crafted file is the way in for the exploited Outlook flaw, so treat unexpected files with suspicion.

For IT teams, patch CVE-2026-124194 first, then the internet-facing remote code execution flaws in the table above, testing as you go. As the head of threat intelligence at watchTowr put it, before going into panic mode, check whether you even use the vulnerable component or meet the conditions needed for exploitation. Start with what you actually have exposed to the internet, then what is already being exploited in the wild, and only then everything else.

Frequently asked questions

How often is Patch Tuesday? Microsoft releases these bundled security fixes on the second Tuesday of each month. The November 2026 release was published on Tuesday 10 November 2026.

What is an NTLMv2 hash? It is a cryptographic response that Windows uses to prove who you are without sending your password over the network. If an attacker captures it, they can use it to impersonate you on other services — which is why the Outlook flaw, which leaks the hash, is serious despite its modest severity score.

I only use webmail. Am I affected by the Outlook flaw? This particular flaw affects Microsoft Outlook when a crafted message file is opened in it. If you never open message files in Outlook, this flaw does not affect you directly — but the same release fixes hundreds of Windows flaws, so installing the updates still matters.

Why do different sites report different totals? Because they count different things. Some totals count only vulnerabilities Microsoft itself issued, while others include CVE identifiers issued by other organisations for flaws fixed in the same release. The exploited Outlook flaw is the same in every count, and it is the one that matters most.