Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability.
This Patch Tuesday addresses 66 "Critical" vulnerabilities, 48 of which are Remote Code Execution (RCE), 15 are Elevation of Privilege (EoP), and three are Use-After-Free in Microsoft Edge.
The approximate number of bugs in each vulnerability category is listed below:
Of the 1,235 vulnerabilities, approximately 639 are categorized under Windows or Microsoft Windows products/components.
When BleepingComputer reports on Patch Tuesday security updates, we only count vulnerabilities released by Microsoft on Patch Tuesday itself.
Therefore, today's total excludes 108 flaws fixed earlier this month, including one Entra Device Registration, 82 Mariner, and 25 Microsoft Edge flaws.
November's Patch Tuesday comes after a record-breaking 1,411 flaws in the October updates as Microsoft continues to use AI to find and patch vulnerabilities.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5132061 & KB5131087 cumulative updates and the Microsoft Windows 10 KB5131096 extended security update.
This month's Patch Tuesday fixes one zero-day vulnerability in Microsoft Outlook that was exploited in attacks.
Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited when no official fix is available.
The actively exploited zero-day vulnerability addressed in the November 2026 Patch Tuesday updates is:
CVE-2026-124194 - Microsoft Outlook Spoofing Vulnerability
Microsoft patched a Microsoft Outlook Spoofing zero-day vulnerability that was actively exploited in attacks to steal NTLM account hashes.
"An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook," warns Microsoft.
"Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Exploitation requires network connectivity and user interaction."
This type of vulnerability is known as an NTLM credential disclosure flaw, where a malicious attachment, when opened, causes Windows to connect to an attacker-controlled network share.
When connecting, Windows may automatically attempt to authenticate to the remote server, exposing the user's NTLMv2 authentication hash, which can then be captured by the attacker and potentially cracked offline.
The recovered credentials could then be used to gain unauthorized access to corporate accounts.
Similar vulnerability have been exploited in the past, typically through malicious attachments sent in phishing campaigns.
Other vendors who released updates or advisories in November 2026 include:
Below is the complete list of resolved vulnerabilities in the November 2026 updates. Note, this report does include the flaws fixed earlier this month.
To access the full description of each vulnerability and the systems it affects, you can view the full report here.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX…
