Patch Tuesday — November 2026: Microsoft Fixes 1,093 Vulnerabilities, Including an Exploited Outlook Zero-Day

After the record-breaking 1,407 vulnerabilities in October, Microsoft fixed 1,093 security flaws with the November 2026 Patch Tuesday. A zero-day in Outlook is already being exploited and can leak Windows authentication information. Windows 11 23H2, meanwhile, is receiving its final updates. Here’s what you need to know.

On Tuesday, November 10, 2026, Microsoft published its monthly batch of security fixes for the penultimate time in 2026. As a reminder, October 2026’s Patch Tuesday set a new record with 1,407 fixed flaws. This month, the total drops to 1,093 vulnerabilities (not counting Edge flaws), or 314 fewer. Make no mistake: that is still the second-largest Patch Tuesday in history, ahead of September’s 973 flaws. Microsoft’s MDASH system struck again...

This month, Windows accounts for 733 flaws. Microsoft Office also appears on the list (174), along with SQL Server (52), SharePoint Server (27), and Exchange Server (9). Another interesting figure: nearly one flaw in two (535) is a privilege escalation issue (meaning it allows an attacker who already has a foothold on a machine to gain higher rights). There are also 296 vulnerabilities leading to remote code execution. In total, 63 flaws are considered critical.

So which vulnerabilities deserve special attention? Here are the ones worth mentioning:

• LDAP (CVE-2026-119958) : a remote code execution flaw with a solid CVSS score of 9.8 out of 10. An unauthenticated attacker can execute code in the context of the LDAP service by sending a series of specially crafted requests, with no user interaction required. Since LDAP is the protocol used to query the Active Directory directory, domain controllers are affected. Microsoft nevertheless considers exploitation to be "less likely".
• Active Directory (CVE-2026-118146 and CVE-2026-118148) : two critical flaws in Active Directory Domain Services, therefore on domain controllers. The first one (8.8 out of 10) allows an authenticated attacker with low privileges (for example, a standard account) to execute code on the server via a crafted request. The second one (7.5 out of 10) allows an authenticated attacker to obtain SYSTEM privileges, the highest level on a Windows machine. It does, however, require winning a race condition. In both cases, Microsoft rates exploitation as "more likely".
• Outlook (CVE-2026-110043, CVE-2026-110068 and CVE-2026-111309) : three remote code execution vulnerabilities classified as critical (CVSS scores of 8.8 out of 10). In all three cases, the reading pane is the attack vector: simply displaying a booby-trapped email is enough, with no need to open an attachment or click a link.
• Exchange Server (CVE-2026-118207) : a critical remote code execution flaw (8.8 out of 10). An authenticated attacker, even with a low-privilege account, can execute code on the server by sending a malicious request. The fix is included in security update KB5133453 for Exchange Server SE (Subscription Edition). Exchange 2016 and 2019 are not on the list for a simple reason: their Extended Security Updates (ESU) program ended in October 2026. That does not mean those versions are not vulnerable, however...
• Windows Search (CVE-2026-116928) : a remote code execution flaw classified as critical and also rated 9.8 out of 10. According to Microsoft, an unauthenticated attacker can target the Windows Search component used by Exchange Server by sending an email with a malicious attachment. Exchange processes the attachment automatically to index it, so the recipient does not need to open the email — the attack happens on the mail server side. The fix is included in Windows cumulative updates, not in the Exchange security update.
• Schannel (CVE-2026-119952) : Schannel is the Windows component that handles encrypted TLS connections. This critical flaw (8.1 out of 10) allows an unauthenticated attacker to execute remote code with a specially crafted packet. The attack does depend on specific configurations, which limits the risk of mass exploitation according to Microsoft. The company still classifies exploitation as "more likely".
• Hyper-V (8 CVE) : eight privilege escalation vulnerabilities affect Microsoft’s hypervisor. With CVE-2026-113861 for example (7.5 out of 10), an attacker with elevated privileges inside a virtual machine can execute code on the Hyper-V host, even though it is subject to a race condition. This is an example of a VM escape on Hyper-V, which is always dangerous.

Where should you start? Here is the order I would recommend:

• Workstations : Office updates, for the Outlook zero-day detailed below and the three flaws exploitable through the reading pane.
• Domain controllers : the Windows Server cumulative update, for the LDAP flaw and the two Active Directory issues.
• Exchange servers : the Windows Server cumulative update, for the Windows Search flaw and the OWA bug, as well as the Exchange SE security update.
• Hyper-V hosts : the Windows Server cumulative update.

A Zero-Day Already Being Exploited in Outlook - CVE-2026-124194

This month, Microsoft fixed just one zero-day. As a reminder, a vulnerability is called a zero-day when it is exploited by attackers, or made public, before a fix is available. In this case, the vulnerability is already being exploited in attacks!

With a CVSS score of 6.5 out of 10, which is not very high, CVE-2026-124194 is nevertheless being exploited. This vulnerability is a spoofing flaw in Outlook. Microsoft assigns it only moderate severity. Proof that severity is not everything.

Here is the attack scenario: the attacker sends the target a specially crafted malicious file (Microsoft refers to a malicious Office file, without specifying its format). When the user opens it, Outlook connects to a network location controlled by the attacker, without displaying the usual warning about external content. The risk is that this connection leaks the user’s NTLMv2 hash.

This is not the password itself, but an attacker who captures this information can try to crack it offline to recover the password. The NTLMv2 hash can also be used in relay-style NTLM attacks.

"Exploitation requires network connectivity and user interaction," Microsoft says. Indeed, the victim must open the malicious file for the attack to trigger. The Redmond company provides no details about the attacks observed.

This flaw affects Microsoft 365 Apps for Enterprise, as well as Office LTSC 2021 and Office LTSC 2024. The fix is delivered through Office updates: for Office LTSC, the patched versions are 16.0.14334.21048 (LTSC 2021) and 16.0.17932.21140 (LTSC 2024). It is also a reminder of NTLM’s weaknesses, a protocol Microsoft wants to phase out. In a previous article, I detailed Microsoft’s 3-phase plan to disable NTLM by default in Windows.

The End of the Road for Windows 11 23H2 and an Exchange Bug Fixed

Beyond the vulnerabilities, this Patch Tuesday brings two important pieces of information for administrators:

• Windows 11 23H2 Enterprise and Education : the November 2026 update is the last one for these editions, according to Microsoft’s published lifecycle. Home and Pro editions have no longer been supported since November 2025. It is time to move to a newer version, such as Windows 11 25H2 or 26H2.
• Exchange Server : were you affected by the OWA (Outlook on the web) and email sending outage that appeared after the Windows Server updates in October 2026? According to the KB5131080 support page, this issue is fixed by the November 10, 2026 updates. The same note appears on the Windows Server 2016, 2019, and 2022 updates.

November 2026 Windows Updates

Even though I plan to publish additional articles on the new updates, here is the list of cumulative updates released this month:

• Windows 10 - KB5131096: Here Is the November 2026 Security Update
• Windows 11 KB5132061: Here’s What You Need to Know About the November 2026 Update (with an important change for NTLM)

For Windows 11 24H2, only the Enterprise and Education editions are still affected, as the Home and Pro editions received their final update in October. For Windows 10, these updates are reserved for LTSC editions and machines enrolled in the ESU program.

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio