Microsoft's November 10 Patch Tuesday fixes 1,094 security flaws, but the only one already being used in attacks is rated Moderate and lives in Outlook. That fix comes through Office's own updates, not through the Windows cumulative update most people think of as Patch Tuesday.
On the Windows side, Windows 11 versions 25H2 and 26H2 get KB5132061, with no known issues listed at release. It also closes out the USB audio bug that left some devices showing Code 10 in Device Manager. For most home PCs, this is an update to install rather than one to wait on.
How many flaws Microsoft fixed in the November 2026 Patch Tuesday
Microsoft's November 2026 release notes count 1,094 Microsoft CVEs. Windows accounts for 726 of them and Office for 174, followed by SQL Server with 59, developer tools with 53 and SharePoint Server with 27. Azure, Exchange Server, Defender and a handful of other products make up the rest.
Microsoft rates 64 of the flaws Critical, 1,029 Important and just one Moderate, which turns out to be the exploited Outlook bug. Elevation of privilege bugs lead with 536 entries, ahead of 296 remote code execution flaws and 156 information disclosure bugs.
The headline number is less alarming than it looks. None of the 1,094 is marked as publicly disclosed before the fix. One Critical Azure OpenAI flaw was already fully mitigated by Microsoft, so no one has to install anything for it.
The Outlook zero-day Microsoft marks as exploited
The flaw to know is CVE-2026-124194, which Microsoft calls an Outlook Spoofing Vulnerability. It carries a Moderate severity rating and a CVSS score of 6.5, and Microsoft's exploitability field reads "Exploitation Detected".
According to Microsoft, an attacker sends a specially crafted message file and convinces someone to open it in Outlook. Opening it can make Outlook connect to a server the attacker controls without the usual external-content warning, leaking the user's NTLMv2 hash.
That hash can be used to authenticate as the victim, which is why a Moderate bug still matters. Microsoft says the Preview Pane is not an attack vector, so the file has to be opened.
The affected versions are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, in 32-bit and 64-bit editions. The fixed builds are 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024. The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on November 10, giving federal agencies until November 24 to patch.
Windows 11 KB5132061 and the other November cumulative updates
KB5132061 brings Windows 11 26H2 to build 26300.9974 and 25H2 to build 26200.9974. On 24H2 it delivers build 26100.9974, but only to Enterprise and Education editions, because Home and Pro support for 24H2 ended on October 13.
Windows 11 version 26H1 gets KB5132059, build 28000.3501. Microsoft's Security Update Guide lists KB5131087 for Windows 11 23H2, build 22631.7711, and KB5131096 for Windows 10 22H2, build 19045.7846, on PCs still eligible for those updates.
Beyond the security fixes, KB5132061 picks up the changes from the October 28 preview update. It fixes the USB Audio 1.0 Code 10 failure, an error 87 when adding a printer published in Active Directory, and Remote Desktop connections that broke after the October preview. The 24H2 build also fixes HDMI and DisplayPort audio on certain AMD graphics cards.
It updates Cuba's daylight saving rules, widens the pool of PCs eligible for the new Secure Boot certificates, and makes Windows clients offer NTLM message signing by default.
Known issues in the November 2026 Windows updates
For both KB5132061 and KB5132059, Microsoft says it "is not currently aware of any issues with this update". On the release health page, the USB audio issue for 26H2 moved to Resolved on November 10, and every other listed 26H2 issue was already marked resolved.
One change can trip up scripts at work. PowerShell now validates encoding more strictly when it checks signed scripts, so a script with invalid UTF-8 may fail signature validation even though it passed before. Microsoft's fix is to re-save the script as UTF-8 with a byte order mark and sign it again.
There will also be no optional preview update in the second half of December 2026, Microsoft says, with normal monthly servicing resuming in January 2027.
What to do after the November 10 Patch Tuesday updates
Open Settings, go to Windows Update and select Check for updates, then restart when asked. Typing winver in the Start menu shows your build; on Windows 11 26H2 it should read 26300.9974 or later.
Then update Office separately, since that is where the exploited flaw lives. Microsoft 365 Apps update on their own schedule, but in Outlook you can go to File, Office Account, Update Options and Update Now to pull the fix immediately.
Until that is done, be wary of unexpected message files and Office attachments, because this attack needs you to open one. IT teams have a firmer deadline in CISA's November 24 date, and the next Patch Tuesday lands on December 8.
Discussion (0)
Be the first to comment.