By Andrew Armstrong 
November 2026 Patch Tuesday landed on 10 November, and it is a big one. Microsoft has fixed 1,095 of its own CVEs this month, 64 of them rated Critical, and one is already being exploited in the wild. The twist is that the exploited bug is not in Windows at all. It is in Outlook, so your Windows cumulative updates will not cover it on their own.
Below is everything you need for this month: the zero-day, the critical Windows bugs worth prioritising, the KB numbers and builds for Windows 11, Windows 10 and Windows Server, the known issues, and the changes that could catch admins out.
November 2026 Patch Tuesday at a glance
| Microsoft CVEs fixed | 1,095 |
| Rated Critical | 64 |
| Exploited zero-days | 1 (CVE-2026-124194, Outlook) |
| Publicly disclosed | 0 |
| Elevation of privilege | 536 |
| Remote code execution | 296 |
| Information disclosure | 157 |
On top of Microsoft’s own fixes, the Security Update Guide also lists third party CVEs this month, mostly Chromium fixes that come through in Microsoft Edge.
The zero-day: CVE-2026-124194, Microsoft Outlook spoofing
This is the one to deal with first. Microsoft has marked CVE-2026-124194 as Exploitation Detected. On paper it only scores 6.5 and is rated Moderate, but that undersells it.
According to Microsoft, an attacker sends a specially crafted message file and gets the user to open it in Outlook. Outlook then connects to an attacker-controlled network location without showing the usual external content warning, and that leaks the user’s NTLMv2 hash. With that hash the attacker can try to authenticate as the user. The Preview Pane is not an attack vector, so the user does have to open the file.
The fix is an Office update, not a Windows one. Make sure Microsoft 365 Apps and any volume licensed Office installs are on this month’s build. If your update channels or deferrals are holding Office back, this is the month to push them through. Our guide to deploying Microsoft 365 Apps updates covers how to force a refresh.
Critical Windows vulnerabilities to prioritise
With 64 Critical CVEs, a lot of them in Office and Hyper-V, here are the Windows and server-side ones we would put near the front of the queue. None are known to be exploited yet.
| CVE | Component | Impact | CVSS | Microsoft’s rating |
|---|---|---|---|---|
| CVE-2026-119958 | Windows LDAP | Remote code execution | 9.8 | Exploitation Less Likely |
| CVE-2026-116928 | Windows Search | Remote code execution | 9.8 | Exploitation Less Likely |
| CVE-2026-118146 | Active Directory Domain Services | Remote code execution | 8.8 | Exploitation More Likely |
| CVE-2026-118207 | Exchange Server | Remote code execution | 8.8 | Exploitation More Likely |
| CVE-2026-119952 | Windows Schannel | Remote code execution | 8.1 | Exploitation More Likely |
| CVE-2026-113862 | Windows NAT | Remote code execution | 8.1 | Exploitation More Likely |
The Active Directory Domain Services bug means domain controllers should be among the first servers you patch, and the Schannel one touches anything doing TLS. If you run Exchange on premises, get the Exchange security update on as well, because the Windows cumulative update does not include it.
November 2026 KB numbers and build numbers
| Operating system | KB | Build after update |
|---|---|---|
| Windows 11 26H2 / 25H2 | KB5132061 | 26300.9974 / 26200.9974 |
| Windows 11 24H2 (Enterprise and Education) | KB5132061 | 26100.9974 |
| Windows 11 23H2 | KB5131087 | 22631.7711 |
| Windows 10 22H2 (ESU) | KB5131096 | 19045.7846 |
| Windows Server 2025 | KB5131080 | 26100.33822 |
| Windows Server 2022 | KB5131090 | 20348.5870 |
Worth knowing: Microsoft says this is the last update for Windows 11 23H2 Enterprise and Education. If you still have devices on 23H2, it is time to plan the upgrade. Windows 10 22H2 only gets this update if the device is enrolled in Extended Security Updates.
Known issues this month
- Windows 11: Microsoft says it is not currently aware of any issues with this update.
- Windows Server 2025 WSUS: WSUS still does not show synchronisation error details. Microsoft removed them on purpose as a mitigation for an earlier WSUS vulnerability, and there is no date for them coming back.
- Exchange and Outlook on the web: the problem where users could not sign in to Outlook on the web, or mail sat in the outbox, is listed as resolved by this update.
- Signed PowerShell scripts: encoding checks for signed scripts are stricter now, so a signed script saved with invalid UTF-8 can fail its signature check.
What admins need to do
- Patch Office, not just Windows. The exploited bug is in Outlook, so Microsoft 365 Apps and Office need this month’s update.
- Check NTLM signing. Clients now offer NTLM message signing by default for non anonymous connections, and there is new auditing for connections that do not use signing. Use that audit to find older devices and apps that might struggle.
- Re-sign affected PowerShell scripts. Re-save any signed scripts that fail as UTF-8 with a byte order mark, then sign them again.
- Servicing your own install media? Include the boot.stl file, or devices can fail to boot from that media with error 0xc0430001. Our guide to slipstreaming updates into Windows installation media walks through the process.
One planning note: Microsoft says there will be no non-security preview update in December this year.
Suggested patch order
- Office and Microsoft 365 Apps, because of the exploited Outlook bug.
- Domain controllers, then other servers, with the LDAP, AD DS and Schannel fixes in mind. Exchange servers get their own security update too.
- Windows clients, then keep an eye on the NTLM signing audit and your signed scripts over the following week.
Sources
- Microsoft Security Update Guide: November 2026 release
- CVE-2026-124194: Microsoft Outlook Spoofing Vulnerability
- KB5132061: Windows 11 26H2, 25H2 and 24H2
- KB5131087: Windows 11 23H2
- KB5131096: Windows 10 22H2
- KB5131080: Windows Server 2025
- KB5131090: Windows Server 2022
Discover more from TechyGeeksHome
Subscribe to get the latest posts sent to your email.
