Microsoft fixed 1,094 security flaws in a single day this week. That’s a number so big it stops meaning anything — until you hear the next part. Attackers were already using one of those flaws before the fix even existed, and it lives in Outlook, the app millions of people open before they’ve finished their first coffee.
That’s the short version of the November 2026 Patch Tuesday. The longer version matters too, because “just install the update” is easy advice to ignore when you don’t know what’s actually at stake. So here’s the plain-English version: what happened, which flaw can’t wait, and what to update first. The whole job takes about ten minutes.
What Is Patch Tuesday, Anyway?
The November 2026 Patch Tuesday landed on Tuesday 10 November, right on schedule. Every month, on the second Tuesday, Microsoft releases a bundle of security fixes for Windows, Office and its other products.
Most months the bundle is a few dozen fixes. This month it wasn’t. Microsoft’s own release notes count 1,094 vulnerabilities, 63 of them rated critical. Some tallies you’ll see online go higher — up to 1,235 — because they also count fixes for the Chromium code inside Microsoft Edge. Same release, different counting. The Microsoft-only number is 1,094, and Windows accounts for the biggest share of it, 726 flaws, followed by Office with 174.
Here’s the thing most coverage skips: a big number doesn’t mean your computer is in danger right now. Most of these flaws need very specific conditions to exploit, and most will never be used against anyone. What matters is the small handful that are already being used — or that are so severe they’d be the first thing an attacker reaches for. This month, that handful is short, and it’s worth knowing by name.
The One Flaw That Can’t Wait
Every Patch Tuesday has a headliner. This month it’s CVE-2026-124194, a flaw in Microsoft Outlook that Microsoft itself has marked “Exploitation Detected”. That label means attackers were already using it before Tuesday’s fix arrived.
How the Attack Works
It works like this. An attacker sends you a specially crafted message file. If you open it in an affected version of Outlook, the app quietly connects to a server the attacker controls — without showing the usual warning about external content. That connection hands over your NTLMv2 hash.
What’s an NTLMv2 hash? Think of it as a scrambled copy of your Windows password. An attacker can’t read your password from it directly, but they can try to crack it offline, or in some setups use the hash itself to sign in as you on other systems. Either way, it’s the kind of thing you don’t want leaving your computer.
Two details matter here. First, the Preview Pane is not the problem — Microsoft says simply previewing the message doesn’t trigger it; you have to open the file. Second, Microsoft rates the flaw only “Moderate”, with a CVSS score of 6.5. That sounds reassuring until you remember the score measures how bad the flaw is in theory. “Already being exploited” measures what’s actually happening. The second one wins.
The crafted file usually arrives disguised as something ordinary — an invoice, a delivery notice, a document from a colleague. It’s the same trick behind spear phishing, where the message is tailored to you so it doesn’t look like spam at all. That, more than any technical detail, is why this flaw works: it doesn’t need you to do anything reckless. It just needs you to open a file that looks like part of your working day.
Who’s Affected — and the One Catch
The flaw affects the desktop versions: Microsoft 365 Apps for Enterprise, and Office LTSC 2021 and 2024. Outlook on the web, Outlook for Mac and the mobile apps aren’t on the affected list. And here’s the catch — the fix doesn’t come through the Windows update. It comes through the Office update, which is exactly why people miss it.
America’s cybersecurity agency, CISA, added this flaw to its Known Exploited Vulnerabilities list on 10 November, with a fix deadline of 24 November for federal agencies. You don’t need a deadline to act, but if you use Outlook on a Windows PC, this is the update to install first. CSO’s breakdown of the release puts the same flaw at the top of its list, for the same reason.
Three More Flaws Worth Knowing About
After the Outlook flaw, three others stand out — mostly because of who they affect.
Exchange Server (CVE-2026-118207, rated 8.8). A remote code execution flaw in Exchange Server. If your company runs its own Exchange server, this one lets an authenticated attacker run code on it. The fix ships in a separate Exchange update, KB5133453, so it won’t arrive with the normal Windows update.
SharePoint Server (CVE-2026-120002, rated 9.9). A privilege-escalation flaw — the highest score in the whole release. An attacker who gets in at a low level could climb to full control of the server. If that sounds abstract, picture a locked office where a visitor’s badge suddenly opens every door, including the server room.
Windows Search (CVE-2026-116928, rated 9.8). This one’s the quietest and possibly the nastiest for businesses: a flaw in the Windows Search component that Exchange uses for indexing, which could let an emailed attachment run code with no click at all. The normal Windows cumulative update fixes it, so home users are covered by the same update as everything else.
If you’re a home user, you don’t need to memorise any of this. The Windows update covers the Search flaw. The Office update covers Outlook. That’s the whole job for most people.
About That Big Number
So why did the November 2026 Patch Tuesday contain 1,094 flaws in one month, when the same month last year had just 63? Microsoft hasn’t given a single tidy reason, but one factor is public: the company has been using AI models to hunt for vulnerabilities in its own products since the summer, and Microsoft credited the Outlook flaw’s discovery to a researcher working with Anthropic’s Claude. More hunting finds more flaws. That sounds alarming, but the alternative — flaws nobody finds — is worse.
There’s also a useful reality check in the numbers. A report published this week, Azul’s 2026 AI Vulnerability Gap Report, found that 90% of Australian organisations surveyed had suffered a patching-related incident or near-miss, and 45% take four to six days to deploy a critical patch. The risk usually isn’t that a fix doesn’t exist. It’s the gap between the fix arriving and someone installing it. This article is about closing that gap.
November 2026 Patch Tuesday: What to Update First
Don’t try to do everything at once. Go in this order, and you’ll have covered the real risk in about ten minutes.
Office First, Then Windows
1. Outlook and Office first. This is the exploited flaw, so it goes first. Open any Office app, go to File, then Account, then Update Options, then Update Now. If you’re on Microsoft 365 Apps, the fix is in the November Office update; on Office LTSC 2021 or 2024, look for builds 16.0.14334.21048 and 16.0.17932.21140 or later. Restart Outlook when it asks.
2. Windows next. Head to Settings, then Windows Update, then Check for updates. On Windows 11 versions 24H2, 25H2 and 26H2 the update is KB5132061; on 23H2 it’s KB5131087. One restart covers the lot. BleepingComputer’s rundown of both updates lists the build numbers if you want to double-check yours afterwards.
Finish With Chrome and a Quick Check
3. Chrome while you’re at it. Google shipped Chrome 157 on 9 November, fixing a flaw of its own — CVE-2026-125350 — that was also being exploited in the wild. CISA added it to the same list on the same day, with the same 24 November deadline. Chrome usually updates itself, but it only finishes the job when you relaunch it. If you haven’t closed your browser in days, now’s the moment.
4. Check it actually installed. After the restart, go back to Settings, then Windows Update, then Update history. You should see the November cumulative update in the list, marked as successfully installed. If it’s not there, you’re not done yet — see the next section.
If an Update Fails
Some people hit trouble with this month’s Windows update — reports of download or installation failures, most commonly error 0x800f0993, surfaced on the day of release. If that happens to you, don’t panic, and don’t switch updates off in frustration. That’s the one response that actually leaves you exposed.
Try this instead. Restart the computer and run Windows Update again; a surprising number of failures clear on the second attempt. If it fails again, run the built-in Windows Update troubleshooter (Settings, then System, then Troubleshoot, then Other troubleshooters). And if it still won’t install, you can download the update manually from the Microsoft Update Catalog by searching for the KB number — KB5132061 for most Windows 11 PCs.
One more thing worth knowing: these updates are cumulative. If you skip a month, the next update includes everything you missed. So even if this month’s install fights you, you haven’t lost the fix — you’ve only delayed it. Just don’t let the delay stretch into weeks.
One More Thing: Windows 11 23H2 Is Done
Buried in this month’s release is a quiet milestone. The 10 November update was the last monthly security update for Windows 11 version 23H2 Enterprise and Education editions. Microsoft recommends moving eligible devices to 26H2. If you’re on a work laptop still running 23H2, ask your IT team what the plan is — the updates stop, but the flaws don’t.
While you’re in the settings, there’s one more habit worth building. Turning on two-factor authentication on your important accounts means a stolen password — or a stolen hash — isn’t enough on its own. It’s the single cheapest safety net in all of this, and it takes less time than the update itself.
The Bottom Line
Patch Tuesday sounds like admin work, and most months it is. This month is different for exactly one reason: someone out there is already using the Outlook flaw, and the fix is sitting there, waiting for you to install it. Everything else in the release can wait for your normal routine. That one can’t.
So: update Office, update Windows, relaunch Chrome, restart. Ten minutes, and the one genuinely urgent item on the list is closed. And if you ever suspect someone has compromised an account, the first hour matters more than anything — here’s what to do in that first hour.
Frequently Asked Questions
I don’t use Outlook. Do I still need the November 2026 Patch Tuesday update?
Yes. The Outlook flaw is the headline, but the Windows update alone covers more than 1,000 other flaws, including the 9.8-rated Windows Search issue. Skipping it because you don’t use one app leaves the rest unfixed.
What exactly is an NTLMv2 hash?
It’s a scrambled version of your Windows password — one that proves who you are to other systems on a network without sending the password itself. Attackers who steal it can try to crack it offline to recover the password, or in some setups use the hash directly to sign in as you.
Why is the Outlook flaw only rated 6.5 if attackers are already using it?
The CVSS score measures how severe a flaw is in theory — how much damage it can do and how hard it is to exploit. “Exploitation Detected” is a separate fact: it tells you the flaw is being used right now, regardless of its score. A moderate flaw that’s actively exploited deserves more urgency than a critical one nobody has touched.
If Something Goes Wrong
My update failed with an error. Am I unprotected?
You’re unpatched, which isn’t the same as already hit — but don’t leave it. Restart and retry the update, run the Windows Update troubleshooter, or download the KB manually from the Microsoft Update Catalog. Updates are cumulative, so the fix will still be there when the install succeeds.
How long do I actually have?
CISA gave US federal agencies until 24 November to fix the Outlook flaw. For everyone else there’s no formal deadline — but attackers were already exploiting the flaw before the fix existed, so “this week” is the honest answer, not “sometime”.
November 2026 Patch Tuesday is a good reminder of how security actually works in practice. The headlines will quote the big number — 1,094 flaws — but the number was never the story. The story is one flaw, in an app you probably opened today, that attackers found before Microsoft did. Install the update, restart your computer, and get on with your day. That’s the whole takeaway.