Microsoft Nov 2026 Patch Tuesday: Outlook zero-day

What happened

Microsoft shipped its November 2026 Patch Tuesday security updates on 2026-11-10. Outlets report different totals, because they count differently:

CrowdStrike: 1,252 CVEs, 68 of them Critical.
BleepingComputer: 1,235 flaws, 66 Critical. It counts only flaws released on Patch Tuesday itself and excludes 108 fixed earlier in the month.
Tenable: 1093 CVEs, 63 Critical.
SecurityWeek: 1,094 flaws.
SANS ISC: 1,260 vulnerabilities, 68 Critical, 167 of them Chromium issues affecting Edge.
Qualys: 1235 vulnerabilities, 63 Critical.

Every source above identifies CVE-2026-124194 as exploited. CrowdStrike, BleepingComputer and Qualys each state that this is the only exploited vulnerability this month. Tenable, SecurityWeek and SANS ISC name it as exploited without giving a total count of exploited flaws.

The zero-day: CVE-2026-124194, Microsoft Outlook spoofing.

Rating: Microsoft rates it Moderate, with a CVSS score of 6.5 (SecurityWeek).
How it works: Microsoft says an unauthenticated attacker could send a specially crafted message file and convince a user to open it. Opening it could make Outlook connect to an attacker-controlled network location without the usual external-content warning, disclosing the user’s NTLMv2 hash (BleepingComputer).
Preview Pane: It is not an attack vector for this flaw (SecurityWeek, CrowdStrike).
Disclosure and attack details: The flaw was not publicly disclosed before the fix. Microsoft’s advisory gives no information about the observed attacks (SecurityWeek).
Credit: The advisory credits a researcher using the moniker “nono” and Benoît Sevens. The acknowledgment for Sevens mentions the use of Anthropic’s Claude AI model (SecurityWeek). Tenable also notes the Claude credit and that no specific version was named.
CISA: Qualys reports that CISA added the flaw to its Known Exploited Vulnerabilities Catalog, with a patch deadline of November 24, 2026.

Other items the sources single out:

Outlook, Critical RCE, preview pane: CrowdStrike says merely selecting a malicious message in the Reading Pane triggers code execution for CVE-2026-110043 and CVE-2026-110068.
LDAP and Active Directory Domain Services: SANS ISC lists CVE-2026-119958 as a critical LDAP RCE. Tenable lists CVE-2026-118146 as a critical AD DS RCE (CVSSv3 8.8, “Exploitation More Likely”), exploitable by an authenticated attacker.
Exchange Server and Schannel: Tenable also lists the critical Exchange Server RCE CVE-2026-118207 (authenticated attacker, “Exploitation More Likely”) and the critical Windows Schannel RCE CVE-2026-119952 (unauthenticated attacker, “Exploitation More Likely”).
End of servicing: This month’s updates are the last for the Enterprise and Education editions of Windows 11 version 23H2 (SecurityWeek).

Am I affected?

For CVE-2026-124194, SecurityWeek lists these affected products:

Microsoft 365 Apps for Enterprise
Office LTSC 2021
Office LTSC 2024

Exploitation requires a user to open a malicious file. Microsoft also says it requires network connectivity (BleepingComputer).

Other Windows, Office, Exchange, SQL Server and Azure components are covered by the wider release. SecurityWeek lists Critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge and the Malware Protection Engine. It also lists Azure OpenAI and Azure Managed Grafana. Use Microsoft’s Security Update Guide for per-product applicability. Exact KB numbers and fixed build numbers for the Outlook fix are not confirmed in the sources.

What to do now

Deploy the November 2026 Office and Microsoft 365 Apps updates, starting with systems running the affected products listed above. The CISA deadline reported by Qualys is November 24, 2026, if you are subject to it.
Install the rest of the November 2026 Windows and Office updates. Review the Critical RCE items in Outlook, LDAP, Active Directory Domain Services, Exchange Server and Schannel listed above.
Check the full per-product list in Microsoft’s Security Update Guide (Tenable points to it for CVEs not covered in its summary). Then scan your environment for systems that are not yet patched, as Tenable recommends.
If you run Windows 11 23H2 Enterprise or Education, plan a move to a supported version, since no further monthly security updates will be released (SecurityWeek).

Microsoft’s advisory gives no details of the observed attacks, and the sources list no indicators of compromise, so none are provided here.

Update, 11 November 2026

HKCERT rates the overall risk of the November release as Medium. Its bulletin lists 14 affected product groups, none rated High or Extremely High: Windows, Extended Security Updates, Azure, Developer Tools, Apps, Other, Microsoft Office, Open Source Software, SQL Server, Server Software, Browser, System Center, Microsoft Dynamics and Mariner.
HKCERT lists the impact types as remote code execution, elevation of privilege, information disclosure, denial of service, security restriction bypass, data manipulation and spoofing. It gives no per-product version ranges.
HKCERT says it rates CVE-2026-124194 Medium because exploitation needs network connectivity and user interaction. It describes the exposed data as authentication information usable to impersonate the user.
The CISA catalog excerpt reviewed for this update shows a Google Chromium use-after-free flaw, CVE-2026-125350, added on 2026-11-10 with a due date of 2026-11-24. CISA says it could affect Chromium-based browsers including Google Chrome, Microsoft Edge and Opera. The update page does not say whether it is part of Microsoft’s release.
That same excerpt does not show CVE-2026-124194, so this update page could not confirm the catalog listing reported by Qualys.

Microsoft November 2026 Patch Tuesday: exploited Outlook zero-day