Microsoft’s November 2026 Patch Tuesday is one of the largest security releases in the company’s history — and one of its flaws was already being exploited before the fix arrived. Released on Tuesday, November 10, the update addresses 1,094 Microsoft-issued vulnerabilities, according to Microsoft’s own Security Update Guide release notes. It is the second month in a row in which Microsoft’s monthly patch volume has exceeded 1,000 flaws.
The headline is not the size of the release, though. It is a single Moderate-rated bug in Outlook, CVE-2026-124194, that attackers were already using to steal the credentials Windows users rely on to sign in to corporate networks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog the same day Microsoft shipped the fix, and gave federal civilian agencies until November 24, 2026 to patch.
If you run Windows or Office — at home or at work — this is the update to install first, and the Outlook fix deserves attention before anything else.
What Microsoft Fixed in November 2026
The November release spans nearly every corner of Microsoft’s software portfolio. The breakdown by product family shows where the bulk of the work landed: 726 flaws in Windows, 174 in Office, 59 in SQL Server, 53 in developer tools and 27 in SharePoint Server, with the remainder spread across Azure, Exchange Server, Defender and other products.
By severity, the picture is striking. Tenable’s breakdown of the release counts 63 critical flaws, 1,029 rated important and a single Moderate-rated flaw — the exploited Outlook bug. The total also includes 165 CVE identifiers issued by other vendors, which is why some tallies of the release run higher, at around 1,259 flaws in total.
For a detailed breakdown of the full tally, see The Hacker News coverage of the release.
The scale is part of a sharp trend. Analysis of Microsoft’s release notes puts November 2025 at just 63 Microsoft CVEs — roughly a seventeenth of this month’s total. Microsoft has linked the growth in part to AI-assisted vulnerability discovery, and this month’s release offers the clearest evidence yet of that shift.
For context, this is not the first massive Patch Tuesday of the season, and it is unlikely to be the last: Microsoft’s December update is scheduled for December 8. The practical takeaway for IT teams is that patch volume is no longer a spike to weather — it is the new normal, and triage matters more than ever.
The Outlook Zero-Day: CVE-2026-124194
The flaw Microsoft marks as exploited is, on paper, the least alarming item in the release. CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook with a CVSS score of just 6.5, rated Moderate. It is the only flaw in the November release that Microsoft lists as “Exploitation Detected,” and none of the month’s flaws was publicly disclosed before the fix shipped.
The attack works like this: a victim receives a specially crafted message file and is persuaded to open it. Outlook then connects to an attacker-controlled network location without displaying the usual external-content warning, and in doing so it can disclose the user’s NTLMv2 hash — the credential material Windows uses to authenticate to network resources. An attacker who captures that hash can use it to impersonate the user on the network.
Three details from Microsoft’s advisory are worth knowing. First, the Preview Pane is not an attack vector — the user has to open the crafted file. Second, the fix does not arrive through the Windows cumulative update: it ships in the Microsoft 365 Apps and Office LTSC builds, so anyone who patches Windows but skips Office updates stays vulnerable. Third, the affected products are Microsoft 365 Apps for Enterprise and Office LTSC 2024 and 2021; Office 2019 is not on the affected list, its support having ended on October 14, 2025.
The discovery credit tells its own story about how security research is changing. Microsoft’s acknowledgment lists “Benoît Sevens using Claude with Anthropic” alongside a researcher who goes by “nono.” It is a small credit line with large implications: AI assistants are now part of the vulnerability discovery pipeline at the highest level.
CISA’s response underlines the urgency. The agency added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10, requiring federal civilian agencies to apply the fix by November 24, 2026. Everyone else should treat that date as a deadline, not a suggestion — exploited flaws do not wait for convenient maintenance windows.
For more on the exploited flaw and its AI-assisted discovery, see WebProNews reporting on the Outlook zero-day and Claude credit.
Two 9.8-Rated Flaws That Need No User Interaction
Beyond the exploited Outlook bug, the November release contains critical remote code execution flaws that are dangerous precisely because they ask nothing of the victim. Two of them score 9.8 out of 10 on the CVSS scale and need no user interaction at all.
The first, CVE-2026-116928, is an out-of-bounds write in Windows Search that Microsoft says lets an unauthorized attacker execute code over a network. The second, CVE-2026-119958, is a similar out-of-bounds write in the Lightweight Directory Access Protocol (LDAP), the service at the heart of Active Directory environments. A network-reachable LDAP flaw in a domain environment is the kind of bug attackers build campaigns around.
They are not alone. The release also patches remote code execution flaws in Windows Schannel (CVE-2026-119952), the Windows Virtual Filtering Platform (CVE-2026-95962) and the Windows Xbox Live Networking Service (CVE-2026-112967), plus bugs in Exchange Server (CVE-2026-118207) and Active Directory Domain Services (CVE-2026-118146), and a privilege escalation flaw in Azure OpenAI. In total, the release fixes 48 critical remote code execution vulnerabilities.
The pattern is familiar from other recent security news: the most dangerous flaws are often the quiet ones. The recent OpenSSH password-bypass flaw affecting Alpine Linux showed the same dynamic — a server-side bug with no user interaction required is worth far more to an attacker than a flashy flaw that needs a victim to click.
AI Helped Find the Bugs — Including Claude
One of the most interesting details in the November release is not a vulnerability at all. It is who — or what — found them.
Analysis of the release notes found that 24 of the 1,093 entries published on November 10 credited a researcher as using an AI model in the discovery. Twenty-three of those named GLM from z.ai; one named Claude. The Outlook zero-day itself was found with Claude’s help. Microsoft’s Security Response Center has said publicly that advanced AI models are part of its vulnerability discovery process, and that releases were expected to keep trending larger as AI-assisted research scales.
That is a genuine shift in how software gets secured. For years, the security industry debated whether AI would help attackers or defenders more. The November numbers suggest the answer, at least for now, is both — and that defenders are using the same tools. The same week also saw NVIDIA hand its OpenShell runtime for securing autonomous AI agents to the CNCF, another sign that the industry is building guardrails for an AI-driven world as fast as it builds the AI itself. Enterprises are also learning how to govern and recover AI agents when those agents go wrong.
There is a flip side worth stating plainly. AI-assisted discovery finds more bugs, which means bigger Patch Tuesdays and heavier triage workloads for the teams that have to deploy the fixes. The 17-fold year-over-year growth in Microsoft’s monthly CVE count is, in part, a measure of success — flaws found and fixed before attackers find them. But it only helps if the patches actually get installed.
What to Patch First: A Priority Order
With more than a thousand fixes, nobody patches everything at once. Here is the order security teams are recommending for the November release.
First, patch Outlook. The exploited flaw is the only one with confirmed in-the-wild abuse, and the fix ships through Microsoft 365 Apps and Office LTSC updates — not the Windows update. Check that Office updates are actually flowing in your environment; many organizations patch Windows diligently and let Office lag.
Second, patch the critical network-facing remote code execution flaws: Windows Search (CVE-2026-116928) and LDAP (CVE-2026-119958), along with the Schannel and Virtual Filtering Platform fixes. These are the flaws that let an attacker in without any help from a user, and they should go out to servers and domain controllers as fast as your change process allows.
Third, cover Exchange Server and SharePoint Server. Both are perennial targets, both are internet-facing in many organizations, and both have flaws in this release. If you run either, do not let them sit until the next cycle.
Fourth, apply the Windows 11 security update KB5132061, which enables clients to offer NTLM message signing by default for non-anonymous connections — a hardening step that directly reduces the value of a stolen NTLMv2 hash like the one the Outlook flaw exposes.
Finally, use the deadline as a forcing function. CISA’s November 24 due date applies to federal agencies, but it is a sensible target for everyone. If your patch cycle cannot hit it, at least make sure the Outlook fix and the two 9.8-rated RCE flaws are done by then.
The Malwarebytes analysis of the November Patch Tuesday offers a similar triage guide for the same release.
Why Patch Tuesday Keeps Getting Bigger
The November release raises an obvious question: why are Microsoft’s monthly updates suddenly so large? The honest answer is a mix of better detection and a bigger attack surface.
AI-assisted discovery is the most visible driver. When researchers — and Microsoft’s own teams — can scan code with AI models, they find classes of bugs that manual review missed, and they find them faster. Microsoft’s own leadership has said releases were expected to keep trending larger as this capability scales. The 24 AI-credited entries in this month’s release are a small share of the total, but the direction of travel is clear.
The attack surface is growing too. Windows, Office, Azure, SQL Server, Exchange, SharePoint, Defender — each product family adds its own flaws to the monthly count, and the count grows as Microsoft ships more software, faster. The same week as Patch Tuesday, SAP’s November Security Patch Day included four vulnerabilities with a perfect CVSS score of 10, a reminder that the trend is industry-wide, not a Microsoft-only story.
For users and administrators, the implication is practical rather than philosophical. Patching is no longer a monthly chore to fit around other work; it is a core operational rhythm, and the organizations that do it well are the ones that automate the routine fixes and reserve human judgment for triage. Knowing which flaw is exploited, which ones are network-reachable, and which ones need no user interaction is the difference between a patched network and a breached one.
Governments have noticed, too. The way how governments fight cybercrime is evolving alongside the threat, with exploited-vulnerability catalogs like CISA’s KEV list becoming a central tool for forcing timely patching across critical infrastructure.
Frequently Asked Questions
Is the Outlook flaw really being exploited?
Yes. Microsoft marks CVE-2026-124194 as “Exploitation Detected,” and CISA added it to its Known Exploited Vulnerabilities catalog on November 10, 2026. Microsoft has not disclosed how many attacks occurred, who was targeted, or whether exploitation is ongoing.
Do I need to open the email for the Outlook attack to work?
The attack requires the victim to open a specially crafted message file. Microsoft states in its FAQ that the Preview Pane is not an attack vector — simply previewing the message is not enough.
Will the Windows update fix Outlook?
No. The Outlook fix ships in Microsoft 365 Apps and Office LTSC builds, not in the Windows cumulative update. You need to apply the Office updates to be protected.
What is an NTLMv2 hash, and why does it matter?
An NTLMv2 hash is credential material Windows uses to authenticate a user to network resources. If an attacker captures it, they can use it to impersonate the user — potentially gaining access to file shares, servers and other systems the user can reach.
When is the patch deadline?
CISA requires federal civilian agencies to patch CVE-2026-124194 by November 24, 2026. That date is a sensible target for every organization, not just federal agencies.
The Bottom Line
Microsoft’s November 2026 Patch Tuesday is big, but its message is simple: patch Outlook first, patch the network-facing critical flaws second, and do it by November 24. The exploited Outlook bug is a reminder that severity scores do not tell the whole story — a Moderate-rated flaw with active exploitation matters more than a Critical-rated flaw nobody is using yet.
The broader story is just as important. AI is now finding vulnerabilities at a scale humans never could, including the very flaw attackers were already exploiting. The Gemini 4 Carbon launch the same week showed how capable AI models have become at long-horizon work — and the security world is feeling that capability on both sides of the attack. The teams that keep up will be the ones that treat patching as a continuous discipline, not a monthly event.
Install the updates. Check that Office actually updated. And mark November 24 on the calendar — it is the date by which the exploited flaw should be closed everywhere.
