Microsoft fixes 1,235 flaws, one exploited Outlook zero-day

By Olivia Hart

Microsoft's November 2026 Patch Tuesday fixes 1,235 security flaws, 66 of them rated Critical, including one actively exploited Outlook zero-day tracked as CVE-2026-124194.

The volume works out to roughly 41 flaws a day across a 30-day month, and it does not cover the whole month. Microsoft's 1,235 excludes 108 flaws fixed earlier in November — one Entra Device Registration bug, 82 in Mariner and 25 in Edge — because the tally counts only what shipped on Patch Tuesday itself.

October ran bigger. That cycle fixed a record 1,411 flaws, and Microsoft paired the volume with continued use of AI to find and patch vulnerabilities.

What did Microsoft fix?

The approximate category split shows a platform heavy on privilege escalation and code execution:

• 536 elevation of privilege vulnerabilities
• 296 remote code execution vulnerabilities
• 157 information disclosure vulnerabilities
• 142 Microsoft Edge (Chromium-based) vulnerabilities
• 46 denial of service vulnerabilities
• 27 security feature bypass vulnerabilities
• 22 spoofing vulnerabilities

About 639 of the 1,235 sit under Windows or Microsoft Windows products and components — just over half the total.

Within the Critical tier, 48 bugs allow remote code execution, 15 raise privileges, and three are use-after-free faults in Edge. The Critical list extends well beyond mail: Hyper-V, Windows Message Queuing, CredSSP, Azure OpenAI, Microsoft Defender, Exchange Server, Windows Schannel, Windows TPM and the Windows print spooler components all carry Critical entries.

Non-security updates shipped alongside. They include the Windows 11 cumulative updates KB5132061 and KB5131087, plus the Windows 10 extended security update KB5131096.

What does the Outlook zero-day actually do?

Microsoft's advisory on CVE-2026-124194, an Outlook spoofing flaw, says: "An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook."

The company warns that "Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Exploitation requires network connectivity and user interaction."

In practice, opening the file makes Windows connect to an attacker-controlled network share. Windows may then authenticate automatically, handing over the user's NTLMv2 authentication hash. An attacker can capture that hash, crack it offline, and use the recovered credentials against corporate accounts — a pattern matching earlier phishing campaigns that weaponized malicious attachments.

The CVE table still rates CVE-2026-124194 Moderate, even though attackers were already using it. Microsoft counts a flaw as a zero-day when it is publicly disclosed or actively exploited and no official fix exists. The same list also carries a separate Windows NTLM spoofing flaw, CVE-2026-121680, rated Important.

Who else patched in November?

Nine other vendors and the Linux distribution ecosystem shipped advisories in the same window:

• Barracuda Networks patched two flaws that let attackers run commands with root privileges; attackers exploited them a week later.
• Cisco released security updates for numerous products, including critical vulnerabilities in Catalyst SD-WAN Controller, Secure Email Gateway and Meraki.
• Google issued emergency Chrome updates for a new vulnerability exploited in zero-day attacks.
• Ivanti fixed two Connect Secure (ICS) remote access gateway flaws chained in zero-day attacks since at least October 1.
• N-able is working on a hotfix for an alleged 30-plus publicly disclosed zero-days, a disclosure that pushed it to take its hosted N-central environments offline.
• Linux distributions patched an OpenSSH and musl authentication bypass tracked as *sshole.
• SAP's November security updates include fixes for four maximum-severity vulnerabilities.
• SonicWall fixed seven SonicOS firewall vulnerabilities, including an SSL-VPN authentication bypass exploited in attacks.
• Vates released a fix for a critical Xen Orchestra authentication bypass under active exploitation.
• Zyxel patched a zero-day in its GS1900 network switches, exploited to compromise nearly 1,000 devices worldwide.

What does this change for enterprise defenders?

It changes the order of operations, not the size of the queue. CVE-2026-124194 carries confirmed field exploitation and targets mail clients on every desk, and the exposure depends on a user opening a crafted file plus network connectivity, so mail and network paths both matter.

Then comes the inventory: 639 Windows-linked fixes, a separate NTLM spoofing bug, and nine vendors with advisories of their own in the same month. Microsoft has closed the zero-day. The rest is the queue enterprises still have to work through before the next Patch Tuesday sets its own record.