November 2026 Patch Tuesday Fixes 1,235 Flaws: Update Outlook Now to Close a Live Zero-Day

The November 2026 Patch Tuesday is out, and Microsoft fixed 1,235 flaws in one go, including an Outlook bug that attackers were already using. If you read email in desktop Outlook, install this month’s updates this week rather than letting them sit.

Here’s the short version before the detail:

• Released November 10, 2026, with 66 vulnerabilities rated critical, according to BleepingComputer.
• One actively exploited zero-day, CVE-2026-124194, is an Outlook spoofing flaw used to steal NTLM password hashes.
• Windows 11 25H2 and 26H2 get KB5132061 and need a restart.
• Windows 11 24H2 Home and Pro no longer receive updates at all.

The list is long, but the practical to-do list is short. The rest of this post sorts what matters from what’s just a big number.

What the November 2026 Patch Tuesday numbers actually mean

A count of 1,235 sounds like a crisis, but it’s inflated by scope. BleepingComputer’s tally includes 142 Edge (Chromium) fixes and a pile of Linux-related Mariner entries, and only about 639 of the total touch Windows itself. It also leaves out 108 flaws Microsoft patched earlier in the month, so trackers will disagree on the final figure.

The breakdown by type is more useful than the headline. Elevation of privilege leads with 536 flaws, followed by remote code execution at 296 and information disclosure at 157.

Of the 66 critical ones, 48 allow remote code execution, 15 allow privilege escalation and 3 are Edge use-after-free bugs. For a home PC, that mostly means one thing: automatic updates will handle it. For an admin, it means a heavy testing week.

How the Outlook zero-day steals your sign-in hash

CVE-2026-124194 is the one flaw Microsoft says was exploited before a fix existed. Per BleepingComputer, an attacker sends a specially crafted message file, and when you open it, Outlook quietly connects to a location the attacker controls. The usual warning about external content never appears.

That connection hands over your NTLM hash, a scrambled form of your Windows password. Attackers can try to crack it offline and then use it to get into corporate accounts. Exploitation needs network access and a user to open the file, which is why it’s rated Moderate.

Don’t let the label lull you. A “Moderate” bug that’s already in real attacks is more urgent than a “Critical” one nobody has touched. The attack is a quiet one, so you may never see a symptom.

While you wait for the patch to reach every machine, standard NTLM hardening helps. That’s general security advice, not something listed in Microsoft’s advisory:

• Block outbound SMB traffic (TCP port 445) to the internet at your firewall.
• Restrict or audit NTLM use where your environment allows it.
• Be wary of unexpected message files, even from contacts.

Blocking outbound SMB matters because it stops the hash from leaving your network even if someone opens the bad file.

Which update does your PC need?

It depends on your Windows version. This table pulls together the details from Windows Latest and BleepingComputer.

Updates install on their own unless you’ve paused them. If you want it now, open Settings, go to Windows Update and select Check for updates.

What else ships with this month’s Windows 11 update

KB5132061 also bundles the features that arrived in the late-October preview. If you’re on 26H2, our guide to getting Windows 11 26H2 covers the upgrade itself.

On the fix side, Windows Latest lists several long-running annoyances finally resolved:

• Smart App Control can be turned back on for some PCs.
• Always On VPN no longer gets stuck on “Connecting.”
• HDMI and DisplayPort audio works again on certain AMD graphics cards.
• Nested virtualization in WSL2 works again on AMD processors.

Not everything is solved. Some USB Audio Class 1.0 devices may still show Code 10 or play no sound, and Phone Link can still lose Android phones after sleep. Admins building install media should also include the boot.stl file, or devices may fail to boot with error 0xc0430001.

Secure Boot certificate rollout is still in progress as well. PCs without the new certificates keep booting normally, and you can check yours with our Secure Boot certificate guide.

A quick plan for today

Most people need about five minutes. Work through these in order:

1. Open Settings, then Windows Update, and select Check for updates.
2. Install KB5132061 and restart when prompted.
3. Open Outlook and update it (File, Office Account, Update Options) or let Microsoft 365 Apps update itself.
4. Confirm your build number with winver after the restart.

If you manage a fleet, patch Outlook first and test the Windows update on a pilot group. The recent Mark of the Web bypass is another reminder that file-opening flaws get exploited fast.

Frequently Asked Questions

Is the November 2026 Patch Tuesday update safe to install?

Microsoft lists a few known issues, mainly USB audio devices and Phone Link, but nothing that should stop a normal install. Back up first if you rely on a USB audio interface.

How do I know if I was hit by the Outlook zero-day?

There’s no visible symptom. Attackers get your hash silently, so the safe move is to patch Outlook and, if you suspect exposure, change your password.

Do I need to update if I only use web Outlook?

The reported flaw affects the Outlook desktop client, so web-only users aren’t the target. Installing Windows updates is still smart.

Why does the number of fixed flaws differ between websites?

Trackers count differently. Some include Edge and Mariner entries and the flaws patched earlier in the month, others stick to the Patch Tuesday release alone.

The bottom line

Ignore the record-sized headline and act on the one bug that matters: update Outlook today, then let Windows Update finish the rest. If you’re still on 24H2 Home or Pro, treat the missing update as the real warning and plan your move to 25H2 or 26H2 now.