Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability.

This Patch Tuesday addresses 66 "Critical" vulnerabilities, 48 of which are Remote Code Execution (RCE), 15 are Elevation of Privilege (EoP), and three are Use-After-Free in Microsoft Edge.

The approximate number of bugs in each vulnerability category is listed below:

• 536 Elevation of Privilege Vulnerabilities
• 27 Security Feature Bypass Vulnerabilities
• 296 Remote Code Execution Vulnerabilities
• 157 Information Disclosure Vulnerabilities
• 46 Denial of Service Vulnerabilities
• 22 Spoofing Vulnerabilities
• 142 Microsoft Edge (Chromium-based) Vulnerabilities

Of the 1,235 vulnerabilities, approximately 639 are categorized under Windows or Microsoft Windows products/components.

When BleepingComputer reports on Patch Tuesday security updates, we only count vulnerabilities released by Microsoft on Patch Tuesday itself.

Therefore, today's total excludes 108 flaws fixed earlier this month, including one Entra Device Registration, 82 Mariner, and 25 Microsoft Edge flaws.

November's Patch Tuesday comes after a record-breaking 1,411 flaws in the October updates as Microsoft continues to use AI to find and patch vulnerabilities.

To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5132061 & KB5131087 cumulative updates.

Microsoft patches 1 zero-days

This month's Patch Tuesday fixes one zero-day vulnerability in Microsoft Outlook that was exploited in attacks.

Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited when no official fix is available.

The actively exploited zero-day vulnerability addressed in the November 2026 Patch Tuesday updates is:

CVE-2026-124194 - Microsoft Outlook Spoofing Vulnerability

Microsoft patched a Microsoft Outlook Spoofing zero-day vulnerability that was actively exploited in attacks to steal NTLM account hashes.

"An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook," warns Microsoft.

"Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Exploitation requires network connectivity and user interaction."

This type of vulnerability is known as an NTLM credential disclosure flaw, where a malicious attachment, when opened, causes Windows to connect to an attacker-controlled network share.

When connecting, Windows may automatically attempt to authenticate to the remote server, exposing the user's NTLMv2 authentication hash, which can then be captured by the attacker and potentially cracked offline.

The recovered credentials could then be used to gain unauthorized access to corporate accounts.

Similar vulnerability have been exploited in the past, typically through malicious attachments sent in phishing campaigns.

Recent updates from other companies

Other vendors who released updates or advisories in November 2026 include:

• Barracuda Networks released security updates for two vulnerabilities that can let attackers run commands with root privileges. A week later, these flaws were exploited in attacks.
• Cisco released security updates for numerous products, including critical vulnerabilities Catalyst SD-WAN Controller, Secure Email Gateway, and Meraki.
• Google released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks.
• Ivanti released security updates to patch two Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1.
• N-able is working on a hotfix for an alleged 30+ zero-days that were publicly disclosed yesterday, causing the company to take its hosted N-central environments offline.
• Linux distributions released security updates to fix an authentication bypass flaw involving OpenSSH and musl, dubbed "*sshole".
• SAP released the November security updates, which include fixes for four maximum-severity vulnerabilities.
• SonicWall released security updates for seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks.
• Vates released security updates for a critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks.
• Zyxel patched a zero-day vulnerability in its GS1900 series network switches that was exploited to compromise nearly 1,000 devices worldwide.

The November 2026 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the November 2026 updates. Note, this report does include the flaws fixed earlier this month.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.