Patch Tuesday, November 2026: Exploited Outlook Flaw, Exchange and AD Fixes, and What to Deploy First

Microsoft’s November 2026 Patch Tuesday, released on Tuesday 10 November, fixes one vulnerability already exploited in attacks: CVE-2026-124194, an Outlook spoofing flaw that BleepingComputer reports has been used to steal NTLM password hashes. CISA added it to its Known Exploited Vulnerabilities catalogue the same day. Of the vulnerabilities Microsoft assigned itself this month, its release data rates 64 Critical, including flaws in Exchange Server, Active DirectoryThe KBY LexiconActive DirectoryActive Directory is Microsoft's directory service for identity, access and policy management. This entry defines its LDAP/Kerberos architecture, security boundary role and key distinctions from Microsoft Entra ID. Read Full Context and Office files that can attack through Outlook’s preview pane. If you have not deployed November’s updates yet, start with Office and Outlook, then domain controllers and Exchange.

#How big is it, really?

Patch Tuesday counts have become hard to compare, so here is ours. Microsoft’s November release data (the CVRF document behind the Security Update Guide) lists 1,476 vulnerabilities. Of those, 1,095 were assigned by Microsoft itself; the restThe KBY LexiconRESTREST defines resource-oriented, stateless APIs built on a uniform interface; understanding its constraints clarifies scaling, caching and safe validation of state-changing calls. Read Full Context come from other projects whose code Microsoft ships, mainly Chrome (220, for Edge) and LinuxThe KBY LexiconLinuxLinux is the open-source kernel underlying most server, container and cloud infrastructure; distinct from the distributions built around it. Read Full Context (48, for Azure Linux and Mariner). BleepingComputer, which counts only what Microsoft released on the day itself, puts the total at 1,235. Whichever number you use, it is enormous: BleepingComputer says October’s was even larger, at 1,411.

The number matters less than it looks. Most of these fixes arrive inside the same monthly cumulative updates you would install anyway. What matters is the handful that change the order you deploy in.

#The one being exploited: Outlook CVE-2026-124194

• What it is: Microsoft describes it as Outlook not warning the user about an unsafe action, letting an attacker “perform spoofing over a network”. Microsoft rates it Important, with a CVSS score of 6.5, and marks it “Exploitation Detected”.
• How it is used: BleepingComputer quotes Microsoft as saying a specially crafted message file, once opened, could make Outlook connect to an attacker-controlled network location without the usual external-content warning, potentially disclosing authentication information. BleepingComputer reports it has been exploited to steal NTLM hashes.
• The fix: it is fixed through Microsoft 365 Apps and Office security updates; Microsoft’s release data points to its Microsoft 365 Apps security update release notes for the builds. CISA has set US federal agencies a deadline of 24 November.

Our view: the score undersells it. A stolen NTLM hash can be cracked offline or relayed, and phishing with malicious attachments is the most ordinary attack there is. Patch Outlook first. If you have not already, our advice is to block outbound SMB (TCP 445) from user devices to the internet at your firewall, which stops most attacks of this kind whatever the Outlook build.

#What else to put near the top of the list

From Microsoft’s release data, these are the Critical or “Exploitation More Likely” fixes we would deploy early. None of them is known to be exploited yet.

• Office documents through the preview pane. Microsoft says the preview pane is an attack vector for 18 Office vulnerabilities this month, among them Critical remote code execution flaws in Outlook (for example CVE-2026-110043, CVSS 8.8), Word and Office itself, and Important ones in PowerPoint. A message or file that is only previewed can be enough.
• Exchange Server, CVE-2026-118207 (Critical, CVSS 8.8, “Exploitation More Likely”): remote code execution by an authorised attacker. If you still run Exchange on-premises, this goes in this week.
• Active Directory Domain Services, CVE-2026-118146 (Critical, CVSS 8.8, “Exploitation More Likely”): remote code execution by an authorised attacker, plus CVE-2026-118148, an elevation of privilege also marked “Exploitation More Likely”. Domain controllers are worth the change window.
• Windows Message Queuing (CVE-2026-109459 and CVE-2026-116710, Critical, CVSS 8.1): heap overflows that an unauthenticated attacker could use over the network. Only systems with the Message Queuing feature enabled are exposed; find out which yours are.
• Network-facing Windows components: Critical fixes for TCP/IP (CVE-2026-113859, adjacent network), the SMB server driver srvnet.sys (CVE-2026-113825) and Print Spooler components (CVE-2026-113752, adjacent network).

One Critical item needs nothing from you: CVE-2026-109469 in Entra Device Registration, scored 10.0, is a cloud service flaw that Microsoft marks “Customer Action Required: No”.

#Known issues before you deploy

• SQL Server linked servers. Windows release health says that after updates from 13 October onwards, connections made by SQL Server linked server queries through OLE DB providers (Oracle and PostgreSQL among them) can stay open and accumulate, slowing servers over time. Microsoft says a mitigation is available through Microsoft Support for business and that an out-of-band fix will follow in the next few days. If you run linked servers, watch connection counts after patching, and plan a SQL service restart window.
• Licensing and activation (fixed on Friday). Microsoft says that after the November update, some licensing and activation operations using slmgr (the Software Licensing Management Tool) might fail with error 0x80041008, mainly for organisations that script KMS activation or product key installs. Devices that are already activated stay activated. On Friday 13 November Microsoft released an out-of-band update that fixes it and includes the November security fixes: KB5136489 for Windows Server 2025, KB5136487 for Windows Server 2022, KB5136490 for Windows Server 2019 and Windows 10 Enterprise LTSC 2019, KB5136483 for Windows 11 version 23H2, and KB5136493 for Windows 10 version 22H2 ESU and Windows 10 Enterprise LTSC 2021. For the servers and Windows 10 it is only in the Microsoft Update Catalog. Install it only where you hit the error, or where your build process runs slmgr.
• RD Web Access needs this update. Microsoft says the November update for Windows Server includes an updated RD Web Access experience because browsers are dropping XSLT, which the old one relies on, and that organisations should install it to keep using RD Web Access (KB5130994).
• Remote Desktop error 0xC000000D for non-admin users connecting to devices with Administrator protection enabled was resolved by the update of 28 October, so November’s update includes the fix.

#Our suggested order

1. Microsoft 365 Apps and Office, everywhere (the exploited Outlook flaw and the preview pane flaws).
2. Exchange Server and domain controllers.
3. Servers with Message Queuing enabled, then the rest of the server estate, watching SQL Server linked servers.
4. Workstations through your normal rings.

We will update this story through the week if Microsoft adds known issues, re-releases an update or ships the promised out-of-band fix for SQL Server linked servers.