Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day

Microsoft released its November 2026 Patch Tuesday updates on November 10, addressing 1,235 vulnerabilities across its product line, according to BleepingComputer. This marks the second consecutive month the company has disclosed more than 1,000 flaws, bringing its yearly total past 5,160, The Record reported. The update includes fixes for three critical remote code execution vulnerabilities in Windows Search, LDAP, and Schannel, as well as an actively exploited spoofing flaw in Microsoft Outlook tracked as CVE-2026-124194.

The Outlook vulnerability carries a moderate CVSS score of 6.5 but is the only flaw in the release confirmed as exploited in the wild. Microsoft said an attacker could send a specially crafted message file that, when opened, causes Outlook to connect to an attacker-controlled network location without the usual external-content warning, disclosing the user's NTLMv2 hash. The company confirmed the Preview Pane is not an attack vector. The Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on November 10, giving federal agencies until November 24 to apply fixes.

The three critical RCEs each carry a CVSS score of 9.8 or 8.1. CVE-2026-116928 in Windows Search and CVE-2026-119958 in Windows LDAP both score 9.8 and allow unauthenticated network attackers to execute code, though Microsoft rates exploitation as less likely. The Windows Search flaw can be triggered by sending an email with a crafted attachment to an Exchange server, which processes it for indexing without user interaction. The LDAP flaw could be "quite destructive, especially on Domain Controllers," according to the Zero Day Initiative. CVE-2026-119952 in Windows Schannel scores 8.1 with high attack complexity; Microsoft rates exploitation as more likely but notes specific protocol conditions are required.

For Windows 10 users in the Extended Security Updates program or on Enterprise LTSC, the KB5131096 update brings systems to build 19045.7846 or 19044.7846 respectively. The update also resolves lingering USB Audio Class 1.0 issues introduced in September, adjusts daylight saving time rules for Cuba, and fixes a printer error introduced in October. Microsoft 365 Apps and Office LTSC 2021 and 2024 require separate security updates for the Outlook fix.

Microsoft said the Outlook bug was discovered by Benoît Sevens using Anthropic's Claude AI. Tenable's Satnam Narang noted an attack could allow someone to sign in as the exploited user. CISA also ordered federal agencies to patch exploited vulnerabilities in Barracuda email security products and investigate potential compromises by Friday, while N-able took all hosted N-central environments offline after a researcher found over 30 serious vulnerabilities in the remote management tool.