Microsoft's November 2026 Patch Tuesday, released on 10 November, fixes more than a thousand vulnerabilities again and includes one zero-day that attackers are already using: an Outlook flaw that leaks a user's NTLM password hash when a malicious file is opened. For most admins three items matter more than the headline count: the Outlook zero-day, a critical Exchange remote code execution bug, and a Windows Search bug reachable through Exchange. This guide ranks what to patch first and what to do if you cannot patch today. Facts come from the sources linked, read on 11 November 2026.
How many flaws? Why every outlet gives a different number
Counts differ by what each outlet includes. BleepingComputer counts 1,235, a record, and rates 66 Critical (48 remote code execution, 15 elevation of privilege and three Edge use-after-free), while excluding 108 flaws fixed earlier in the month. SecurityWeek counts 1,094, Ivanti and Dark Reading 1,093 (63 Critical, 1,029 Important, 1 Moderate), Rapid7 1,092 for Microsoft's own products, and the Zero Day Initiative about 1,090. ZDI notes it is less than the roughly 1,400 of October, and that this is the second four-digit Patch Tuesday in a row. The exact number matters less than the split: SecurityWeek lists 726 Windows, 174 Office, 59 SQL Server, 53 developer tools, 27 SharePoint, 20 Azure and nine Exchange Server flaws.
Only one is exploited and none are publicly disclosed this month, according to Microsoft's advisories as summarized by Rapid7 and ZDI.
Patch first: the exploited Outlook zero-day
CVE-2026-124194 is an Outlook spoofing flaw, rated Moderate with CVSS 6.5, confirmed exploited in the wild. If a user opens a specially crafted message file, Outlook connects to an attacker-controlled network location without the usual external-content warning and can disclose the user's NTLMv2 hash. It affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 (Lansweeper). Rapid7 says the Preview Pane is not a vector, which limits the impact somewhat, but it warns the low score hides the value: the hash can be relayed live to another service, or cracked offline. Relay works where services lack message signing for SMB or LDAP, or Extended Protection for Authentication for Exchange or Active Directory Certificate Services (Rapid7).
Exchange and Windows Search
| CVE | What | Severity | Microsoft's exploitation rating | Why it matters |
|---|---|---|---|---|
| CVE-2026-118207 | Exchange Server remote code execution | Critical, CVSS 8.8 | Exploitation More Likely | Needs only a low-privileged login and no user interaction; the only Exchange bug with this rating |
| CVE-2026-116928 | Windows Search remote code execution | CVSS 9.8 | Reached through Exchange | ZDI: an unauthenticated attacker emails a crafted attachment that triggers the bug when the server indexes it; the recipient opens nothing |
| CVE-2026-119952 | Windows Schannel (TLS) pre-authentication remote code execution | Critical | Exploitation More Likely, specific conditions needed | Rapid7: attackers may find vulnerable endpoints easily because Schannel is Windows' TLS stack |
| CVE-2026-118146 / 118148 | Active Directory Domain Services RCE and elevation of privilege | Critical (8.8 and 7.5) | Exploitation More Likely | Lansweeper: together a path from a low-privileged foothold to control of the directory |
Exchange Server gets nine fixes this month: two remote code execution, four elevation of privilege, one denial of service and two spoofing flaws. ZDI advises patching CVE-2026-118207 first together with the Windows Search bug, and not discounting the spoofing issues, which often become credential relaying. The Windows Search fix ships in the Windows OS update, not the Exchange one (Rapid7). Rapid7 also notes that only Exchange Subscription Edition remains in support, since all earlier versions are past end of support, so there is no fix to apply for Exchange 2016 or 2019 without a paid program. Dark Reading also quotes Automox on CVE-2026-110043, a critical Outlook heap overflow that is triggered through the Preview Pane.
A patch-day checklist
- Outlook first. Push the November update for Microsoft 365 Apps and Office LTSC 2021 and 2024 now. Treat the Moderate rating as Critical, as Ivanti advises.
- Exchange SE and the Windows update on every Exchange server. You need both: the Exchange security update and the Windows OS update that carries the Windows Search fix.
- Domain controllers and TLS-facing Windows servers. Prioritize the AD DS and Schannel fixes.
- Limit NTLM damage while you roll out. Block outbound SMB (TCP 445) to the internet at the firewall, turn on SMB and LDAP signing, enable Extended Protection for Authentication on Exchange and AD CS, and reduce NTLM where you can.
- Hunt for leaked hashes. Look for Outlook processes making outbound SMB or WebDAV connections to unfamiliar external hosts. Reset passwords for users who opened suspicious message files.
- Unsupported Exchange. Plan the move to Exchange SE or Exchange Online. See the October Exchange update guide.
Two VPN items from the same week also need action: the Ivanti Connect Secure re-patch and the SonicWall SSL VPN bypass. After patching edge gear, rotate what it saw: rotate secrets after patching.
Frequently asked questions
How many vulnerabilities did Microsoft fix in November 2026? Between about 1,090 and 1,235 depending on how each outlet counts. Most report roughly 1,093 to 1,094, with 63 Critical.
Is there an exploited zero-day? Yes, one: the Outlook spoofing flaw CVE-2026-124194. None are publicly disclosed.
Can the Outlook flaw be triggered in the Preview Pane? No, according to Rapid7. The user has to open the malicious file.
Which Exchange versions get the patch? Exchange Server Subscription Edition. Earlier versions are out of support.