Weekly Admin Brief, 13 November 2026: Outlook Zero-Day, Activation Fix and Sixty Days to Server 2016’s End

This was the week Microsoft 365The KBY LexiconMicrosoft 365Microsoft 365 defined at plain and technical depth, with architecture, operational relevance, an example and a common misunderstanding for practitioners. Read Full Context went down for most of a day, Patch Tuesday fixed an Outlook flaw already being used to steal password hashes, and attackers turned a Check Point firewall flaw into a way to wipe virtual machines. Here is what changed for IT admins in the seven days to Friday 13 November, and what to do about each.

#Our pick of the week: patch Outlook, then block outbound SMB

CVE-2026-124194 is the only Microsoft vulnerability this month marked as exploited. BleepingComputer reports it has been used to steal NTLM hashes through crafted message files, and CISA added it to its exploited list on Tuesday. It is fixed in the November Microsoft 365 Apps and Office updates. We would put it ahead of everything else from Microsoft this month, and, if you have not already, block outbound SMB (TCP 445) from user devices to the internet, which stops this whole class of attack.

#Windows and Windows Server

• November Patch Tuesday (Tuesday 10 November). Exploited Outlook flaw, Critical fixes for Exchange Server, Active DirectoryThe KBY LexiconActive DirectoryActive Directory is Microsoft's directory service for identity, access and policy management. This entry defines its LDAP/Kerberos architecture, security boundary role and key distinctions from Microsoft Entra ID. Read Full Context and Office files that attack through the preview pane. Our full guide, with the order we would deploy in: Patch Tuesday, November 2026.
• Out-of-band fix for activation errors (Friday 13 November). Microsoft says some slmgr licensing and activation operations, such as scripted KMS activation, can fail with error 0x80041008 after the November update. It released out-of-band updates on Friday that fix it; activated devices are not affected. Do: install them only where you see the error. KB numbers are in the Windows message center.
• SQL Server linked servers (known issue, opened Wednesday 11 November). Windows release health says connections from SQL Server linked server queries using OLE DB providers, such as Oracle and PostgreSQLThe KBY LexiconPostgreSQLPostgreSQL is an open-source relational database management system queried with SQL. Read Full Context , can stay open after updates from 13 October onwards and slowly degrade the server. A mitigation is available from Microsoft Support for business, and an out-of-band fix is promised. Do: watch open connection counts on servers that use linked servers.
• RD Web Access needs the November update. Microsoft says browsers are dropping XSLT, which the RD Web Access page relies on, and the November Windows Server update includes a version that does not need it (KB5130994). Do: patch RD Web Access servers before your users’ browsers stop rendering the page.
• Sixty days to go (reminders posted Friday 13 November). Windows Server 2016 reaches the end of extended support, and Windows 10 Enterprise LTSC 2021 the end of mainstream support, on Wednesday 13 January 2027; after that, security updates continue only through Extended Security Updates. Do: list what still runs on them and decide now between upgrade and ESU.

#Apple

• Security updates across every platform (Monday 9 November). Apple released iOS and iPadOS 27.2.1, 26.7.3 and 18.7.12, macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3, watchOS 27.2.1 and 26.6.1 and visionOS 27.2.1. The iOS 27.2.1 and macOS 27.2.1 notes fix several Bluetooth and AirPlay pairing flaws, including one where a malicious Bluetooth device may be able to pair without user interaction. Neither note says any flaw has been exploited. Do: push the updates through your MDM on your normal schedule; there is no emergency here.

#Microsoft Intune and Entra

Intune’s “What’s new” page has no entries dated this week; the latest is the week of 26 October. We found nothing in Entra’s “What’s new” dated this week either. Quiet weeks happen; we would rather say so than pad this list.

#Security and outages

• Microsoft 365 outage (Thursday 12 to Friday 13 November). Outlook, Exchange Online, Teams and Copilot were down or unstable for much of a day worldwide. Microsoft blames an issue from a network capacity upgrade and promises a post-incident report. Do: log your downtime now for the service credit claim, and check your fallback plan does not depend on Teams. Our coverage.
• Check Point gateways (Thursday 12 November). CVE-2026-123039 was chained with PHP2Shell to take root on Security Gateways, in some cases followed by wiping ESXi hosts. Do: install the November Jumbo Hotfix, Mobile Access portals first, and look for the published indicators. Our alert.
• N-able N-central (Thursday 12 November). A new exploit chain works against servers already on the latest hotfix when the Legacy API is enabled. Do: check the Legacy API is off. Our story.
• Expedia (Thursday 12 November). Expedia confirmed a breach through a third-party data platform. The lesson for cloud admins is to remove access you granted vendors you no longer use. Our story.

#On KBY this week

• Patch Tuesday, November 2026: what to deploy first
• Check Point CVE-2026-123039 exploited
• Expedia cyberattack through a third-party vendor
• Jensen Huang resigns as Nvidia CEO: what it means for buyers
• N-able N-central zero-day exploited
• Microsoft 365 outage, November 2026