Microsoft’s November 2026 Patch Tuesday landed on 10 November and it is the biggest one yet. The updates fix a record-breaking 1,235 flaws, including one Outlook zero-day that attackers were already using in the wild to steal Windows login hashes. If you only patch one thing this month, make it Outlook.
Here is the full breakdown, plus what Windows 11 KB5132061 and KB5131087 change on the desktop side.
November 2026 Patch Tuesday: The Numbers
Microsoft addressed 1,235 vulnerabilities on Patch Tuesday itself, the highest monthly total so far. Of those, 66 are rated Critical: 48 Remote Code Execution, 15 Elevation of Privilege and 3 Use-After-Free flaws in Microsoft Edge.
The category split, as counted by BleepingComputer:
- 536 Elevation of Privilege
- 296 Remote Code Execution
- 157 Information Disclosure
- 142 Microsoft Edge (Chromium) flaws
- 46 Denial of Service
- 27 Security Feature Bypass
- 22 Spoofing
About 639 of the flaws sit in Windows or Windows components. The total excludes 108 fixes Microsoft shipped earlier in the month, including one Entra Device Registration flaw, 82 Mariner flaws and 25 Edge fixes. For context, October 2026 patched 1,411 flaws, and the monthly totals keep climbing as Microsoft leans on AI tooling to find and fix bugs faster.
The Zero-Day: CVE-2026-124194 (Outlook NTLM Theft)
The one actively exploited flaw this month is CVE-2026-124194, a Microsoft Outlook spoofing vulnerability. Microsoft’s advisory describes the attack plainly: an unauthenticated attacker sends a specially crafted message file and convinces the user to open it.
Opening the file makes Outlook connect to an attacker-controlled network location without showing the usual external-content warning. Windows then tries to authenticate to that server automatically, leaking the user’s NTLMv2 hash. Attackers capture the hash and crack it offline, which can hand them valid corporate credentials.
This class of NTLM credential disclosure bug has been used in real intrusions before, and Microsoft confirmed this one was exploited in attacks before the patch. Exploitation needs network access and the user to open the file, which is exactly why it arrives disguised as email attachments.
Windows 11 KB5132061 and KB5131087
On the Windows 11 side, the cumulative updates are KB5132061 for versions 26H2, 25H2 and 24H2, and KB5131087 for 23H2. They are mandatory because they carry this month’s security patches. The two releases share the same base since 25H2 and 26H2 are built on 24H2, so there are no version-exclusive changes.
The headline new feature is a rebuilt File Explorer context menu:
- It opens faster and shows less clutter.
- A new Customize menu option at the bottom opens a Settings page where you can turn built-in commands such as Send to and Create shortcut on or off.
- You can add commands like Print to the right-click menu.
There are also minor File Explorer fixes bundled in. To install, go to Start, then Settings, then Windows Update and check for updates, or grab the standalone packages from the Microsoft Update Catalog.
Windows 10 Gets KB5131096
Windows 10 is not left out entirely. Microsoft released KB5131096 as an Extended Security Update, the paid programme for machines that stayed on Windows 10 after its support ended. If you run a business fleet on Windows 10 ESU, this one carries the same Patch Tuesday security fixes.
Home users on Windows 10 without the ESU programme get nothing this month, which is the reminder most of those machines need. If your PC cannot move to Windows 11 because of hardware checks, at least harden the browser and email client, since those are the two most attacked entry points on an unpatched system.
What You Should Do Now
- Patch Outlook first. Even if you stagger other updates, install the Outlook fix immediately. CVE-2026-124194 is being exploited and only needs one opened attachment.
- Warn users about unexpected message files. The attack starts with a crafted file attached to a message. Remind your team not to open attachments they were not expecting, even from known contacts.
- Consider restricting NTLM. Where your environment allows it, audit NTLM usage and plan to move to Kerberos. Blocking outbound NTLM to untrusted servers stops this attack class from working even before patches apply.
- Reboot after installing. The cumulative updates will not fully apply until the machine restarts.
- Update your patch dashboard. With 1,235 fixes in one drop, most enterprise tools will need a fresh sync before they report compliance correctly.
If You Cannot Patch Immediately
Some machines always lag, so here is the fallback plan for the Outlook zero-day:
- Restrict outbound NTLM. Group Policy has a “Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers” setting. Blocking it toward untrusted servers cuts off the hash-leak path the attack depends on.
- Turn off attachment previews in Outlook and tell users not to open message files from unexpected mail.
- Segment and monitor. Watch for outbound SMB and WebDAV connections from workstations to unknown internet hosts. That traffic pattern is the attack happening.
How to Check Your Patch Level
Open Settings, then Windows Update, then Update history. The November updates show up as KB5132061 or KB5131087 on Windows 11 and KB5131096 on Windows 10 ESU. If the history shows an older KB, click “Check for updates” and reboot after installation. Businesses using WSUS or Intune should verify the November sync pulled the new definitions before trusting compliance reports.
One more note for planners: Patch Tuesday falls on the second Tuesday of every month, so the next round is due on 8 December 2026. With monthly totals now crossing a thousand flaws, budget patch windows accordingly.
Frequently Asked Questions
What is CVE-2026-124194 in Outlook?
It is a spoofing flaw being exploited in attacks. Opening a crafted message file makes Outlook connect to an attacker server and leak your NTLM hash, which can be cracked into your password. It was patched on 10 November 2026.
Which KB is the November 2026 update for Windows 11?
KB5132061 for Windows 11 versions 26H2, 25H2 and 24H2, and KB5131087 for version 23H2. Both are mandatory cumulative updates with this month’s security fixes.
How many flaws did November 2026 Patch Tuesday fix?
1,235 vulnerabilities, a record monthly total. 66 of them are rated Critical, and roughly 639 affect Windows products.
When is the next Patch Tuesday after November 2026?
Patch Tuesday falls on the second Tuesday of every month, so the next round of updates is due on 8 December 2026.
Did Windows 10 get an update this month?
Yes. KB5131096 was released as an Extended Security Update for Windows 10 machines enrolled in the ESU programme.
