Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day

Microsoft issued security updates addressing 1,235 vulnerabilities across its product portfolio for the November 2026 Patch Tuesday, including an actively exploited zero-day flaw in Microsoft Outlook. The release marks another massive patching volume following the 1,411 flaws resolved in October, as detailed in BleepingComputer's report on the vendor's ongoing rollout. The count covers updates delivered directly on Patch Tuesday, excluding 108 vulnerabilities resolved earlier in the month across Mariner, Entra Device Registration, and Edge components.

This analysis breaks down the breakdown of resolved vulnerabilities, the mechanics of the zero-day flaw, the affected Windows cumulative packages, and corresponding updates across enterprise vendor systems. It is aimed at systems administrators, security operations teams, and IT staff managing Windows enterprise fleets, email infrastructure, and cloud directory environments.

01Outlook zero-day exploits NTLM hashes

The single zero-day vulnerability fixed this month, tracked as CVE-2026-124194, is a spoofing flaw in Microsoft Outlook that attackers actively exploited in wild attacks. The attack vector allows an unauthenticated adversary to deliver a specially crafted message file that requires user interaction to trigger. When an affected user opens the file, Outlook connects to an attacker-controlled network location without displaying the standard external-content warning dialog.

Microsoft warned that opening the malicious file initiates an outbound connection over the network that exposes authentication details. Windows may automatically initiate authentication with the remote attacker server, disclosing the user's NTLMv2 authentication hash. Adversaries can capture these hashes across the network and attempt offline cracking to compromise corporate credentials.

Successful exploitation demands network connectivity alongside user interaction, fitting the operational pattern of targeted email phishing campaigns. Once attackers recover plaintext passwords from cracked hashes, they can impersonate the victim to gain unauthorized persistence inside enterprise accounts. Similar NTLM credential disclosure techniques have been weaponized historically through malicious document attachments.

02Critical remote execution and elevation flaws

The November collection contains 66 vulnerabilities rated Critical by Microsoft, led by 48 Remote Code Execution flaws and 15 Elevation of Privilege bugs. Three additional Critical flaws involve Use-After-Free conditions in Microsoft Edge Chromium components. Windows and Microsoft Windows core components account for approximately 639 of the 1,235 total vulnerabilities listed in the release.

Across the overall vulnerability inventory, Elevation of Privilege represents the largest category with 536 individual bugs. Microsoft also documented 296 Remote Code Execution vulnerabilities, 157 Information Disclosure flaws, and 142 vulnerabilities in the Chromium-based Microsoft Edge browser. The remaining volume comprises 46 Denial of Service vulnerabilities, 27 Security Feature Bypass bugs, and 22 Spoofing flaws.

Specific component fixes address multiple remote execution and privilege elevation bugs inside Windows Active Directory Domain Services, including Critical entries CVE-2026-118146 and CVE-2026-118148. Additional patches resolve vulnerabilities in ASP.NET Core, .NET, Aspire, Azure DevOps Server, Azure CycleCloud, Azure File Sync, and Azure CLI.

03Cumulative update packages for Windows

Administrators managing client and server operating systems must deploy dedicated update packages to resolve the vulnerabilities across endpoints. For Windows 11 systems, Microsoft delivered the fixes through cumulative update packages KB5132061 and KB5131087, which bundle security corrections alongside non-security operating system maintenance.

Enterprise organizations maintaining legacy environments under extended support agreements must install update KB5131096 for Microsoft Windows 10. These cumulative packages apply fixes across underlying OS components, Active Directory hooks, and foundational runtime frameworks like .NET and ASP.NET Core.

The 1,235 count reflects only patches published on Patch Tuesday itself and omits earlier component updates released earlier in November. Those omitted earlier patches include 82 fixes in Mariner, 25 fixes in Microsoft Edge, and one vulnerability in Entra Device Registration.

04Machine learning assisted vulnerability discovery

Microsoft's November volume of 1,235 flaws follows October's record-setting 1,411 resolved bugs, continuing an elevated baseline of monthly vulnerability disclosures. The sustained high volume stems from Microsoft's deployment of artificial intelligence tools designed to scan codebases, isolate memory issues, and automate patch generation.

This automated discovery explains the high concentration of internal component vulnerabilities, such as dozens of discrete flaws isolated across ASP.NET Core and .NET libraries. Component categories showing extensive repetitive fixes include denial of service, privilege escalation, and security feature bypass defects within Aspire and Azure cloud utilities.

Hardware platform components were also serviced within the operating system update scope, including information disclosure entries CVE-2026-84004 and CVE-2026-84005 affecting AMD Zen processor environments. Azure services receiving multiple distinct vulnerability fixes include Azure CycleCloud, Azure DevOps Server, and Azure Confidential Clean Rooms.

05Coordinated security patches across vendors

The November Patch Tuesday rollout coincided with critical security releases published by multiple major networking and software vendors. Cisco issued updates for critical vulnerabilities across Catalyst SD-WAN Controller, Secure Email Gateway, and Meraki hardware platforms, while Google deployed an emergency Chrome update addressing a zero-day flaw exploited in active attacks.

Network security vendors also published critical advisories to counter active intrusions. SonicWall patched seven flaws in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks, while Ivanti patched two Connect Secure gateway bugs chained in zero-days since October 1. Zyxel patched an exploited zero-day in GS1900 series network switches that compromised nearly 1,000 devices worldwide.

Additional enterprise remediations include SAP updates addressing four maximum-severity bugs, Barracuda Networks fixes for root command execution flaws, and Vates updates for an actively exploited Xen Orchestra authentication bypass. N-able took its hosted N-central environments offline while preparing hotfixes for over 30 publicly disclosed zero-days, and Linux distributions published updates for an OpenSSH and musl authentication bypass vulnerability dubbed Asshole.