Microsoft’s November 2026 Patch Tuesday fixes more than a thousand vulnerabilities, and one of them is already being used in attacks. BleepingComputer counts 1,235 flaws (including 142 in Microsoft Edge) and says it only counts bugs released on Patch Tuesday itself; Krebs on Security counts 1,093. The tallies differ, but both put the month well into four digits, following October’s record 1,411 (see Microsoft’s October Patch Tuesday Fixes a Record 1,411 Flaws). BleepingComputer lists 66 as “Critical” and Krebs 63; Krebs reports that Microsoft credits AI for helping to find and fix this volume of bugs.
The exploited flaw is CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook. Microsoft’s description, quoted by BleepingComputer, says an unauthenticated attacker could send a specially crafted message file and convince a user to open it; doing so could make Outlook connect to an attacker-controlled network location without the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. BleepingComputer says the flaw was exploited to steal NTLM account hashes: when Windows connects to a remote share it may try to authenticate automatically, handing over a hash that an attacker can try to crack offline and then use against corporate accounts. Exploitation requires user interaction (opening the file) and network connectivity.
How to check if you’re affected
Affected products, according to Krebs on Security’s reading of Microsoft’s advisory for CVE-2026-124194, are Microsoft 365 Apps for Enterprise and editions of Microsoft Office. Neither Krebs nor BleepingComputer lists fixed build numbers for the Outlook flaw, and Microsoft’s update-guide page for it did not render for us, so take the exact fixed version from Microsoft’s advisory.
Install this month’s Office and Microsoft 365 Apps updates and treat unexpected message files (the kind of attachment a phishing email carries) with suspicion until you have. The sources we read describe no workaround that avoids patching; the advice to be wary of unexpected message files is ours.
BleepingComputer has separate articles on the Windows 11 KB5132061 and KB5131087 cumulative updates and the Windows 10 KB5131096 extended security update released the same day; this post does not cover what those updates contain.
Sources
- BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
- Krebs on Security: Microsoft Fixes Nearly 1,100 Security Vulnerabilities
- Microsoft Security Response Center: CVE-2026-124194 advisory (linked from the coverage above; the page returned only a script shell to us, so Microsoft’s statements are attributed to the outlets that quoted them)