November 2026 Patch Tuesday: An Outlook Zero-Day and 1,093 Fixes

Microsoft's November 2026 Patch Tuesday fixes 1,093 vulnerabilities, and the only one already under attack is rated Moderate. It's an Outlook bug that hands an attacker the user's password hash, and severity-first patching would push it to the back of the queue. Here's what to patch first, what changed in the Windows updates, and what could break.

November 2026 Patch Tuesday at a Glance

We counted from Microsoft's own Security Update Guide at 18:20 UTC on 10 November. The count covers new CVEs that Microsoft itself assigned, without the Chromium and third-party entries, so trackers that include those will land higher.

That's down from about 1,400 in October, the record month. Windows takes about 680 of November's fixes, Office 178, SQL Server 54 and SharePoint 27.

The Zero-Day Is an Outlook Bug Rated Moderate

CVE-2026-124194 is a spoofing flaw in Outlook with a CVSS score of 6.5, and Microsoft confirms attackers are already using it. A user opens a crafted message file, and Outlook connects to an attacker's server without showing the usual external-content warning. That connection leaks the user's NTLMv2 hash, which the attacker can use to sign in as that user.

Microsoft's advisory says the Preview Pane isn't an attack vector, so someone has to open the file. One convincing phishing email clears that bar.

The fix doesn't ship in the Windows cumulative update. It comes through Microsoft 365 Apps and Office LTSC (build 16.0.17932.21140 for LTSC 2024, 16.0.14334.21048 for LTSC 2021). Check which update channel your Office installs follow, and spot-check the build on pilot machines before you call it done.

Blocking outbound SMB (TCP 445) at the firewall is the standard defense against this kind of hash leak, because the stolen hash travels on that connection. This month's Windows update adds a second layer: clients now offer NTLM message signing by default, which makes a relayed hash harder to use.

Critical Fixes Grouped by Where They Land

Of the 63 Critical fixes, Microsoft rates five as "exploitation more likely". Four of them sit on servers that the rest of the network trusts.

Office has its own cluster. Eight Critical remote code execution bugs in Outlook, Word and Office list the Preview Pane as an attack vector, so a user only has to look at the message. The same Office update that fixes the zero-day closes these.

The highest scores this month aren't Critical. SharePoint Server (CVE-2026-120002) and Azure DevOps Server (CVE-2026-109467) both score 9.9, and a SQL Server bug (CVE-2026-116945) scores 9.8, all rated Important. If you run any of those on-premises, they belong in week one anyway.

What Changed in the Windows Updates

Two changes in the KB5132061 release notes deserve a pilot-ring test. PowerShell now validates the encoding of signed scripts more strictly, so a signed script with invalid UTF-8 can fail its signature check even though it ran last month. Microsoft's fix is to save the script as UTF-8 with a byte order mark and sign it again.

If your RMM or Intune pushes signed scripts, run them on pilot machines before the broad ring. The second change is the NTLM signing default from the zero-day section, which comes with auditing that shows which connections still don't sign.

Two fixes land as well. The USB Audio Class 1.0 bug from September (error code 10 in Device Manager) is fixed on Windows 11, and so is the October bug where adding a printer published in Active Directory failed with error 87.

For the non-security side of KB5132061, Pureinfotech walks through the new context menu, Cloud Rebuild recovery and Start menu changes in seven minutes.

Known Issues and Deadlines Before You Deploy

One problem from October is still open. The KB5131080 notes for Windows Server 2025 still list the Exchange issue where users can't sign in to Outlook on the web or send mail. Keep October's registry workaround in place and confirm mail flow after the reboot.

The USB audio fix appears in the Windows 11 notes only. The Server 2025 notes don't mention it, so keep the USB audio check in the pilot ring there. If you build install media with dynamic updates, include the boot.stl file, because Microsoft says media without it can fail to start with error 0xc0430001.

November also brings a deadline. Windows 11 version 23H2 Enterprise, Education and IoT Enterprise reach end of servicing on 10 November 2026, per Microsoft's Windows 11 release information. KB5131087 is the last update those devices get.

November is a hotpatch month. Windows 11 Enterprise 24H2, 25H2 and 26H2 and Windows Server 2025 devices enrolled in hotpatch install this release without a restart. Windows Server 2022 hotpatch runs on its own calendar, and there November is a baseline month, so plan the reboot.

The Secure Boot clock ran out in October. Microsoft's Windows Production PCA 2011 certificate expired on 19 October 2026, and KB5132953 says the boot manager signed with it is now frozen. Devices still boot, but they don't get new boot-level protections until their firmware trusts the 2023 certificates, and this month's update widens the set of devices that get those certificates automatically.

Before you push the 2023 certificates to a fleet, back up every BitLocker recovery key. A Secure Boot change can trigger BitLocker recovery on the next start, and that's a bad time to find out a key was never escrowed.

Windows 10 devices only get this release through Extended Security Updates, now in year 2 for commercial customers. If any still sit outside ESU, our Windows 10 end of life guide sorts out what to do with each one.

What to Patch First This Month

The r/sysadmin megathread is where the first breakage reports usually land. Read it before you widen the rollout.

In OpenFrame, Mingo does that read for each machine: it checks each update's known issues against the machine's role and the services running on it, and gives a hold-or-patch call with the reason ($1 per device per month, with a 14-day free trial). Flamingo builds OpenFrame, which competes with other patching tools.

Intune Changes This Month

Intune ships its own monthly service release, usually a week or two after Patch Tuesday. As of 10 November, Microsoft Learn's What's new in Intune page ends at service release 2610 (week of 26 October). Release 2611 is still listed as in development.

The 2610 changes worth a look for Windows fleets:

Apple admins have one change that can't wait. The legacy Apple MDM software update workloads are gone, so update policies for iOS, iPadOS and macOS now run through declarative device management. Microsoft's in development page says 2611 turns on just-in-time registration automatically for eligible iOS and iPadOS tenants.

Defender Updates This Month

Defender doesn't wait for Patch Tuesday. Security intelligence updates (KB2267602) ship continuously, outside the monthly cycle. The antimalware platform (KB4052623) and engine ship as one monthly release.

The newest Windows release is October 2026's: platform 4.18.26100.4 and engine 1.1.26100.4, released on 27 October. Microsoft's Defender release notes list lower CPU use after full scans, and devices under Defender for Endpoint security settings management now show as managed. No November platform had been posted when we checked on 10 November.

That October engine matters this month. The November guide lists CVE-2026-122194, a Critical remote code execution bug in Defender, with engine 1.1.26100.4 as the fix. Devices that took the 27 October engine are already covered, so check for machines stuck on an older one.

Defender for Endpoint added one feature IT teams will want to switch on. Local AI agent discovery on Windows and macOS went generally available in October, and the Windows side needs platform 4.18.26090.9 or later. If people install AI agents on their own laptops, this is how you find them.

Other Vendors Patching the Same Day

Microsoft isn't the only one shipping on the second Tuesday. Here's what the others had published on 10 November.

SAP's November patch day is the one to read first if you run SAP. Four perfect 10.0 scores in internet-facing components don't wait for a quarterly change window.

When Is the Next Patch Tuesday?

The next Patch Tuesday is 8 December 2026 at 10:00 a.m. Pacific, the last one of the year. January's follows on 12 January 2027. Every date through 2027, plus a week-one rollout plan, is on our Patch Tuesday page.

Until then, November's order is short: Office today, domain controllers and Exchange this week, and every Windows machine through the pilot ring first.