Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability.
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability.
This Patch Tuesday addresses 66 Critical vulnerabilities, 48 of which are Remote Code Execution (RCE), 15 are Elevation of Privilege (EoP), and three are Use-After-Free in Microsoft Edge.
The approximate number of bugs in each vulnerability category is listed below: Of the 1,235 vulnerabilities, about 639 are categorized under Windows or Microsoft Windows products/components.
When the outlet's reports on Patch Tuesday security updates, we only count vulnerabilities released by Microsoft on Patch Tuesday itself.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5132061 & KB5131087 cumulative updates and the Microsoft Windows 10 KB5131096 extended security update.
Therefore, today's total excludes 108 flaws fixed earlier this month, including one Entra Device Registration, 82 Mariner, and 25 Microsoft Edge flaws.
The actively exploited zero-day vulnerability addressed in the November 2026 Patch Tuesday updates is: Microsoft patched a Microsoft Outlook Spoofing zero-day vulnerability that was actively exploited in attacks to steal NTLM account hashes.
Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user.
When connecting, Windows may automatically attempt to authenticate to the remote server, exposing the user's NTLMv2 authentication hash, which can then be captured by the attacker and potentially cracked offline.
November's Patch Tuesday comes after a record-breaking 1,411 flaws in the October updates as Microsoft continues to use AI to find and patch vulnerabilities.
This month's Patch Tuesday fixes one zero-day vulnerability in Microsoft Outlook that was exploited in attacks, and microsoft classifies a zero-day flaw as publicly disclosed or actively exploited when no official fix is available.
Other vendors who released updates or advisories in November 2026 include: Below is the complete list of resolved vulnerabilities in the November 2026 updates.
Note, this report does include the flaws fixed earlier this month.
What happened
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability.
This Patch Tuesday addresses 66 Critical vulnerabilities, 48 of which are Remote Code Execution (RCE), 15 are Elevation of Privilege (EoP), and three are Use-After-Free in Microsoft Edge.
The approximate number of bugs in each vulnerability category is listed below: Of the 1,235 vulnerabilities, about 639 are categorized under Windows or Microsoft Windows products/components.
What changed
When the outlet's reports on Patch Tuesday security updates, we only count vulnerabilities released by Microsoft on Patch Tuesday itself.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5132061 & KB5131087 cumulative updates and the Microsoft Windows 10 KB5131096 extended security update.
Who is affected
Therefore, today's total excludes 108 flaws fixed earlier this month, including one Entra Device Registration, 82 Mariner, and 25 Microsoft Edge flaws.
The actively exploited zero-day vulnerability addressed in the November 2026 Patch Tuesday updates is: Microsoft patched a Microsoft Outlook Spoofing zero-day vulnerability that was actively exploited in attacks to steal NTLM account hashes.
Why it matters
Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user.
When connecting, Windows may automatically attempt to authenticate to the remote server, exposing the user's NTLMv2 authentication hash, which can then be captured by the attacker and potentially cracked offline.
Technical details
November's Patch Tuesday comes after a record-breaking 1,411 flaws in the October updates as Microsoft continues to use AI to find and patch vulnerabilities.
This month's Patch Tuesday fixes one zero-day vulnerability in Microsoft Outlook that was exploited in attacks, and microsoft classifies a zero-day flaw as publicly disclosed or actively exploited when no official fix is available.
Response
Other vendors who released updates or advisories in November 2026 include: Below is the complete list of resolved vulnerabilities in the November 2026 updates.
Note, this report does include the flaws fixed earlier this month.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.