Microsoft released November security updates on November 10, 2026. An actively exploited Outlook vulnerability is among the issues addressed, alongside serious vulnerabilities in Windows and enterprise services.
What Microsoft released
Microsoft’s November 2026 Patch Tuesday release covers products including Microsoft Outlook, Windows, SharePoint and Active Directory Domain Services. A particularly urgent issue is CVE-2026-124194, an Outlook spoofing vulnerability that Microsoft marks as exploited in the wild. TechiesJournal covered the previous month in Microsoft’s October 2026 security updates.
Published analyses disagree about the total number of vulnerabilities. Tenable counts 1,093 CVEs, whereas BleepingComputer counts 1,235. Microsoft’s own November 2026 Security Updates data, read on November 12, lists 1,417 CVE entries. The difference is the counting rule:
| Entries in Microsoft’s November 2026 data | Count |
|---|---|
| Microsoft products other than Microsoft Edge and Azure Linux | 1,093 |
| Microsoft Edge (Chromium-based) | 220 |
| Azure Linux (Mariner) | 104 |
| Total entries | 1,417 |
Entries counted by the products they affect, from Microsoft’s November 2026 security update document (revised November 11). TechiesJournal’s tally.
Tenable’s total equals the first row. That match is TechiesJournal’s observation, not a method Tenable states. BleepingComputer states a different rule: it counts the flaws released on Patch Tuesday and excludes 108 flaws fixed earlier in the month (one Entra Device Registration, 82 Mariner and 25 Edge). Microsoft’s document also grew after November 10, because 81 entries carry a November 11 initial release date. No single figure should be called the Microsoft total without its counting rule. The immediate security priority is whether an organization’s systems are affected and patched.
Source: Microsoft Security Update Guide, November 2026 and its machine-readable data.
Exploited Outlook vulnerability: CVE-2026-124194
CVE-2026-124194 is a Microsoft Outlook spoofing vulnerability. Microsoft’s advisory says an unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning. That discloses the user’s NTLMv2 hash, which the attacker could use to authenticate as the user.
The scenario requires user interaction and network connectivity, and Microsoft states that the Preview Pane is not an attack vector. It does not imply that simply receiving an ordinary email compromises every Outlook client.
Exploitation status: Microsoft marks it exploited and not publicly disclosed. Severity: Microsoft rates it Moderate, with a CVSS v3.1 base score of 6.5 (network attack vector, user interaction required, high confidentiality impact, no integrity or availability impact). Severity describes the impact if a flaw is exploited, while exploitation status describes what attackers are doing, which is why a Moderate flaw can be the month’s top priority. Tenable reports the same score.
Affected products and fixed builds: Microsoft lists Microsoft Office LTSC 2021 (32-bit and 64-bit editions), fixed in build 16.0.14334.21048, Microsoft Office LTSC 2024 (32-bit and 64-bit editions), fixed in build 16.0.17932.21140, and Microsoft 365 Apps for Enterprise (32-bit and 64-bit), which is updated through Microsoft’s Office security release notes.
Official record: Microsoft CVE-2026-124194. Supporting reports: BleepingComputer, Tenable.
Other important November vulnerabilities
Microsoft’s data highlights additional vulnerabilities worth checking in affected deployments. None of the four below is marked exploited or publicly disclosed, so they should not be grouped with the Outlook flaw.
| CVE and vulnerability | CVSS v3.1 and Microsoft severity | Microsoft exploitability label |
|---|---|---|
| CVE-2026-120002, SharePoint Server elevation of privilege (incorrect authorization) | 9.9, Important | Exploitation Less Likely |
| CVE-2026-119958, Windows LDAP remote code execution (out-of-bounds write) | 9.8, Critical | Exploitation Less Likely |
| CVE-2026-118146, Active Directory Domain Services remote code execution (incorrect authorization) | 8.8, Critical | Exploitation More Likely |
| CVE-2026-119952, Windows Schannel remote code execution (observable timing discrepancy) | 8.1, Critical | Exploitation More Likely |
From Microsoft’s November 2026 security update document, read on November 12, 2026. These are highlighted vulnerabilities, not the complete inventory. Exploitability labels are Microsoft’s assessments for the latest software release.
Their exploitation prerequisites and affected configurations differ. Microsoft rates the Active Directory Domain Services and Schannel issues “Exploitation More Likely”, which is a reason to place them early in exposure-based planning even though no exploitation is reported.
What IT teams should do
Prioritize affected Outlook installations. Identify Office LTSC 2021, Office LTSC 2024 and Microsoft 365 Apps for Enterprise installations covered by CVE-2026-124194, apply the Microsoft-provided updates, and verify that endpoints reach build 16.0.14334.21048 (LTSC 2021), build 16.0.17932.21140 (LTSC 2024) or the fixed Microsoft 365 Apps build in Microsoft’s release notes. Pay attention to remote devices and systems on delayed update channels.
Review critical enterprise services. Determine whether affected SharePoint installations, domain controllers and Windows services are present. Prioritize remediation according to Microsoft’s applicability information, exposure and business criticality. Use established maintenance and recovery procedures for directory services and other critical systems.
Confirm update deployment. Check that patches are installed, required restarts are completed and relevant services remain healthy. For domain controllers, verify authentication and replication as appropriate.
Investigate when there is evidence of compromise. Review relevant authentication and endpoint events if suspicious Outlook activity is detected. Applying a patch addresses the vulnerability going forward but does not prove a previously compromised system is clean.
The Microsoft Security Update Guide remains the authoritative location to determine affected versions, updates and installation requirements.
What organizations should take away
The exploited Outlook flaw gives administrators a specific November priority. Other high-impact issues affecting SharePoint, Windows LDAP, Active Directory and Schannel require exposure-based assessment and timely patching. The operational goal is not to react to a headline count but to confirm that affected systems received the relevant security updates.
Sources
- Microsoft November 2026 Security Update Guide
- Microsoft Outlook CVE-2026-124194
- Microsoft November 2026 security update data
- Tenable November 2026 assessment
- BleepingComputer November 2026 report
Sources were read on November 12, 2026. Microsoft can revise its advisories, so counts and build numbers can change.