Microsoft November 2026 Patch Tuesday Addresses 1,235 Vulnerabilities, Outlook Zero-Day Fixed

• •Microsoft fixed 1,235 vulnerabilities in November 2026 Patch Tuesday, including one zero-day.
• •CVE-2026-124194 is an actively exploited Outlook spoofing vulnerability leaking NTLMv2 hashes.
• •Administrators should apply the updates immediately to protect against potential exploitation.

On November 10, 2026, Microsoft released its Patch Tuesday updates, fixing a record 1,235 vulnerabilities, including one actively exploited zero-day in Microsoft Outlook. The zero-day, identified as CVE-2026-124194, is a spoofing vulnerability that can leak NTLMv2 authentication hashes to attackers. This month's updates include 66 vulnerabilities, with 48 classified as Remote Code Execution (RCE). The Outlook flaw allows unauthenticated attackers to send specially crafted messages that, when opened, connect to an attacker-controlled network, potentially exposing sensitive authentication information. Microsoft has categorized approximately 639 of the vulnerabilities under Windows or Microsoft Windows products. The updates come after a previous record of 1,411 flaws patched in October 2026. Administrators are urged to apply the updates promptly to mitigate risks.