November 2026 Patch Tuesday: Outlook Zero-Day to Fix Now

In short: Microsoft's November 2026 Patch Tuesday, released on 10 November 2026, fixes more than 1,000 vulnerabilities, including an Outlook spoofing flaw (CVE-2026-124194) that Microsoft says was exploited in the wild. Indian IT teams should update Office and Windows quickly, starting with Outlook, Exchange, domain controllers and SharePoint.

What Happened

On 10 November 2026, Microsoft released its monthly security updates. According to Tenable's analysis of the release, the update addresses 1,093 CVEs, with 63 rated Critical. Other outlets report different totals, such as BleepingComputer's figure of 1,235, because they count related and third-party fixes differently. Every source agrees on the main point: this is a very large release with one actively exploited zero-day.

The zero-day is CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook. Tenable reports that an attacker who gets a target to open a crafted Office file can expose the target's NTLMv2 hash, and that the flaw "was exploited in the wild". Microsoft rates it with a CVSS score of 6.5. A report on TheTechHacker notes that the Preview Pane is not an attack vector, so the user has to open the file.

Several other flaws in this release are rated Critical and marked by Microsoft as "Exploitation More Likely", according to Tenable:

• CVE-2026-118146: remote code execution in Active Directory Domain Services (CVSS 8.8).
• CVE-2026-118207: remote code execution in Exchange Server (CVSS 8.8).
• CVE-2026-119952: remote code execution in Windows Schannel (CVSS 8.1).

A SharePoint Server elevation of privilege flaw, CVE-2026-120002, carries a CVSS score of 9.9, though Microsoft marks it "Exploitation Less Likely". Official details for each CVE are in the Microsoft Security Update Guide.

Who Is Affected

Almost every organisation running Microsoft software is affected in some way. The highest priority groups are:

• Companies and government offices using Outlook in Microsoft 365 Apps or Office LTSC 2021 and 2024.
• Organisations with on-premise Active Directory domain controllers.
• Teams running Exchange Server or SharePoint Server on their own servers.
• Any Windows 11 fleet. TheTechHacker reports that the Windows 11 24H2, 25H2 and 26H2 cumulative update is KB5132061.

What It Means for Indian Businesses and Departments

A leaked NTLMv2 hash may sound minor, but attackers can try to crack it offline or relay it to sign in to other systems as the victim. In many Indian offices, NTLM is still enabled for older applications, file shares and printers, so a single opened attachment can become a foothold inside the network.

Exchange, SharePoint and domain controllers are also common in large Indian firms, PSUs and government departments that keep systems on-premise. These servers hold email, documents and every user account, so a delay in patching them carries a high cost.

There is also a reporting angle. Under CERT-In directions, specified cyber incidents must be reported within 6 hours of noticing them. If you see signs of exploitation, your incident process needs to start immediately. Our CERT-In 6-hour reporting checklist explains the steps.

What to Do Now

1. Update Office and Outlook first: Push the November Office updates to all users, because the Outlook fix comes through the Office update channel, not Windows Update alone.
2. Patch domain controllers, Exchange and SharePoint: Test and apply the November updates to these servers within days, not weeks, starting with internet-facing systems.
3. Roll out the Windows cumulative update: Deploy the November cumulative updates to Windows 11 and Windows Server through your patch tool, with a small pilot group first.
4. Reduce NTLM exposure: Block outbound SMB traffic (TCP port 445) to the internet at the firewall and review where NTLM is still in use so you can phase it out.
5. Warn users about attachments: Send a short note telling staff not to open unexpected Office or message files, even from senders they seem to know, and to report them.
6. Check for signs of compromise: Review sign-in logs for unusual NTLM authentication and outbound connections to unknown servers, and start your incident process if anything looks wrong.
7. Record what you patched: Keep a short record of systems updated and dates, which helps with audits and any CERT-In queries.

If your team struggles to keep up every month, our guide to a patch management process shows how to make it routine. Last month's release is covered in Microsoft October 2026 Patch Tuesday.

Frequently Asked Questions

What is CVE-2026-124194?

It is a spoofing vulnerability in Microsoft Outlook, fixed on 10 November 2026. Opening a crafted file can expose the user's NTLMv2 hash. Microsoft reports that it was exploited in the wild before the fix.

How many vulnerabilities did Microsoft fix in November 2026?

Tenable counts 1,093 CVEs, with 63 rated Critical. Some outlets report higher or lower totals depending on what they include, but all agree it is more than 1,000.

Is updating Windows enough to fix the Outlook flaw?

No. The Outlook fix is delivered through Office updates. Make sure Microsoft 365 Apps and Office LTSC installations receive the November Office update as well as the Windows update.

How Affix Center Can Help

Large monthly releases are hard to handle with a small IT team. Affix Center provides managed IT services in Mumbai that include monthly patching, testing and reporting, and our cyber security services team can check your network for NTLM exposure and signs of compromise.

If you need help rolling out the November updates safely, contact our team.