November 2026 Patch Tuesday: Outlook Zero-Day and KB Builds

Microsoft’s November 2026 Patch Tuesday, released on November 10, fixes one flaw that attackers were already using: CVE-2026-124194, a bug in classic Outlook that can hand a user’s NTLMv2 password hash to an attacker when the user opens a crafted file. No other vulnerability in the release was marked as exploited or publicly disclosed, according to Microsoft’s November 2026 release notes.

For a home PC the job is short: install the Windows cumulative update for your version, update Office, then check the build numbers below. Admins have a longer list, starting with Exchange and domain controllers.

The Outlook zero-day: what it does and which build fixes it

Microsoft’s advisory for CVE-2026-124194 describes an unauthenticated attacker sending a specially crafted message file. If the user opens it, Outlook connects to a network location the attacker controls without showing the usual external-content warning, and the user’s NTLMv2 hash goes with that connection. The hash can be used to sign in as the user. The Preview Pane is not an attack vector, so the file has to be opened.

Microsoft rates the flaw Moderate, with a CVSS score of 6.5. CISA added it to its Known Exploited Vulnerabilities catalog on November 10 and gave US federal agencies until November 24 to fix it. The affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024.

In Outlook, File > Office Account > About Outlook shows the version and build. The November fix is in these builds, from Microsoft’s Microsoft 365 Apps security update list:

Which Windows update to install

Each Windows version gets one cumulative update. After installing it, the build shown by winver should match the last column. The figures come from the Security Update Guide data and Microsoft’s KB pages.

Windows 10 22H2 receives the update only on PCs enrolled in Extended Security Updates. Our Windows 10 ESU guide explains who qualifies, and the end-of-life tracker lists the dates for each version.

Microsoft’s KB pages for Windows clients list two known issues so far. On Windows 11 24H2 Enterprise and Education, some devices fail to install the update with error 0x80070306, 0x800f0989 or 0x800f0993; Microsoft says a repair reaches affected devices through Windows Update within 24 to 48 hours from November 11. On Windows 10 Enterprise LTSC 2021, slmgr.vbs activation and KMS commands can fail with error 0x80041008; devices that are already activated stay activated. The Windows 11 update also widens the rollout of the new Secure Boot certificates.

Why reported totals differ

Published counts for this month range from about 1,090 to more than 1,200. We counted the entries in Microsoft’s machine-readable November file on November 12. It lists 1,417 CVEs, but only 1,095 were issued by Microsoft itself. The rest are fixes Microsoft ships for code it bundles: 219 Chromium flaws fixed in Edge, 41 Linux kernel flaws and 62 from other projects. Three of Microsoft’s 1,095 are cloud-service flaws (Entra Device Registration, Azure OpenAI and Azure Managed Grafana) that Microsoft had already fixed on its side, which leaves 1,092 that need an update on your machines.

What admins should patch next

Microsoft marks 42 flaws as more likely to be exploited. On servers, these stand out:

• Exchange Server, CVE-2026-118207 (CVSS 8.8): code execution by an attacker with low-level access, no user interaction, exploitation more likely.
• Active Directory Domain Services, CVE-2026-118146 (8.8): the same pattern on domain controllers, also more likely.
• Windows Search, CVE-2026-116928 (9.8): an email attachment that Exchange indexes can run code without anyone opening it. Microsoft rates exploitation less likely.
• Windows LDAP, CVE-2026-119958 (9.8): unauthenticated code execution through crafted LDAP calls, rated less likely.
• Windows Schannel, CVE-2026-119952 (8.1): remote code execution, rated more likely.

The next Patch Tuesday is December 8, 2026.