Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero

Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability.

This Patch Tuesday addresses 66 "Critical" vulnerabilities, 48 of which are Remote Code Execution (RCE), 15 are Elevation of Privilege (EoP), and three are Use-After-Free in Microsoft Edge.

The approximate number of bugs in each vulnerability category is listed below:

536 Elevation of Privilege Vulnerabilities

27 Security Feature Bypass Vulnerabilities

296 Remote Code Execution Vulnerabilities

157 Information Disclosure Vulnerabilities

46 Denial of Service Vulnerabilities

22 Spoofing Vulnerabilities

142 Microsoft Edge (Chromium-based) Vulnerabilities

Of the 1,235 vulnerabilities, approximately 639 are categorized under Windows or Microsoft Windows products/components.

When BleepingComputer reports on Patch Tuesday security updates, we only count vulnerabilities released by Microsoft on Patch Tuesday itself.

Therefore, today's total excludes 108 flaws fixed earlier this month, including one Entra Device Registration, 82 Mariner, and 25 Microsoft Edge flaws.

November's Patch Tuesday comes after a record-breaking 1,411 flaws in the October updates as Microsoft continues to use AI to find and patch vulnerabilities.

Microsoft patches 1 zero-days

This month's Patch Tuesday fixes one zero-day vulnerability in Microsoft Outlook that was exploited in attacks.

Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited when no official fix is available.

The actively exploited zero-day vulnerability addressed in the November 2026 Patch Tuesday updates is:

CVE-2026-124194 - Microsoft Outlook Spoofing Vulnerability

Microsoft patched a Microsoft Outlook Spoofing zero-day vulnerability that was actively exploited in attacks to steal NTLM account hashes.

"An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook," warns Microsoft.

"Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Exploitation requires network connectivity and user interaction."

This type of vulnerability is known as an NTLM credential disclosure flaw, where a malicious attachment, when opened, causes Windows to connect to an attacker-controlled network .

When connecting, Windows may automatically attempt to authenticate to the remote server, exposing the user's NTLMv2 authentication hash, which can then be captured by the attacker and potentially cracked offline.

The recovered credentials could then be used to gain unauthorized access to corporate accounts.

Similar vulnerability have been exploited in the past , typically through malicious attachments sent in phishing campaigns .

Recent updates from other companies

Other vendors who released updates or advisories in November 2026 include:

Barracuda Networks released security updates for two vulnerabilities that can let attackers run commands with root privileges. A week later, these flaws were exploited in attacks .

Cisco released security updates for numerous products, including critical vulnerabilities Catalyst SD-WAN Controller, Secure Email Gateway, and Meraki.

Google released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks.

Ivanti released security updates to patch two Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1.

N-able is working on a hotfix for an alleged 30+ zero-days that were publicly disclosed yesterday, causing the company to take its hosted N-central environments offline.

Linux distributions released security updates to fix an authentication bypass flaw involving OpenSSH and musl, dubbed "*sshole".

SAP released the November security updates , which include fixes for four maximum-severity vulnerabilities.

SonicWall released security updates for seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks.

Vates released security updates for a critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks.

Zyxel patched a zero-day vulnerability in its GS1900 series network switches that was exploited to compromise nearly 1,000 devices worldwide.

The November 2026 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the November 2026 updates. Note, this report does include the flaws fixed earlier this month.

To access the full description of each vulnerability and the systems it affects, you can view the full report here .

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.