Windows Update November 2026: Exploited Outlook Zero-Day and 1,000+ Fixes
An email lands from "HR" with a file called "Annual bonus schedule". You open it in Outlook. No warning appears and nothing looks odd. In the background, though, Outlook has already reached out to a server run by the attacker and handed over a hashed version of your credentials. That, roughly, is what the zero-day Microsoft fixed in its November 2026 updates does, and attackers were using it before the patch shipped.
In short: On 10 November 2026 Microsoft released its monthly security updates, covering more than a thousand vulnerabilities across Windows, Office and other products. Among them is an actively exploited Outlook spoofing flaw, CVE-2026-124194. The Outlook fix arrives through the Office update, not the Windows update, so you need to install both.
What is in the November 2026 Windows update?
The numbers are large this month, but they depend on how you count. BleepingComputer tallied 1,235 flaws, while the Microsoft release summary cited by Qualys lists about 1,094, including 726 in the Windows family and 174 in Office. Part of the gap comes from third-party CVEs that Microsoft republishes because its products ship that code. According to Qualys, 63 of the vulnerabilities are rated Critical.
For context, the October bundle was bigger still; we covered it in our article on the October 2026 Windows update and its exploited zero-days. So November is not a record month, but it does carry one exploited flaw that deserves attention.
Key facts about this release
- The Windows 11 cumulative update is KB5132061 for versions 26H2, 25H2 and 24H2 (Enterprise and Education editions in the case of 24H2).
- Windows 11 23H2 Enterprise and Education get KB5131087, the final monthly security update for those editions.
- Windows 10 gets KB5131096, but only on devices enrolled in Extended Security Updates (ESU).
- According to Windows Mode, none of this month's Windows CVEs is marked as exploited; the only exploited flaw is in Outlook.
The exploited Outlook flaw CVE-2026-124194: how it works
In its Security Update Guide, Microsoft describes the bug as a spoofing vulnerability rated Moderate, with a CVSS score of 6.5, and marks it "Exploitation Detected". The moderate rating should not lull anyone. Real-world exploitation is what pushes it up the list.
Here is the scenario as Microsoft explains it. An unauthenticated attacker sends a specially crafted message file and convinces the victim to open it in an affected version of Outlook. On opening, Outlook connects to a network location the attacker controls without showing the usual external-content warning. The result is a leak of the user's NTLMv2 hash, authentication data that can be used to impersonate that person on the network.
Two points are somewhat reassuring. The Preview Pane is not an attack vector, and exploitation requires the user to open the file. But persuading people to open files is exactly what phishing emails are good at, which is why this one needs a prompt patch. If the term is new to you, read our explainer on what a zero-day vulnerability is.
CISA deadline: 24 November
The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 10 November and gave US federal agencies until 24 November 2026 to fix it. The deadline only binds the US government, but it is a useful benchmark for any company looking for a clear priority.
Why the Windows update alone is not enough
This is where many people slip. Windows Update finishes, says "You're up to date", and the user assumes the job is done. Microsoft states plainly, however, that the fix for CVE-2026-124194 ships through Microsoft 365 Apps and Office LTSC updates, not through cumulative update KB5132061.
The products listed in Microsoft's advisory are:
| Product | How it is fixed |
|---|---|
| Microsoft 365 Apps for Enterprise (32- and 64-bit) | Office update via Click-to-Run |
| Office LTSC 2024 (32- and 64-bit) | November Office security update |
| Office LTSC 2021 (32- and 64-bit) | November Office security update |
Office 2016 and Office 2019 reached end of support on 14 October 2025 and will not receive new fixes. If you still rely on them, the realistic answer is moving to a supported version.
How to update Windows, step by step
- Open Start, then Settings.
- Select Windows Update in the side menu.
- Click Check for updates.
- Let the cumulative update download and install, then restart when prompted.
- To confirm, open Update history and look for the November 2026 update.
If your PC runs an older Windows 11 version that is out of support, new security updates will not appear at all. Our guide to upgrading to Windows 11 can help in that case.
How to update Office and Outlook, step by step
- Open Outlook, Word or any other Office app.
- Click File, then Office Account (or Account).
- Under Update Options, choose Update Now.
- Close your Office apps if asked so the installation can finish.
- Return to the same page to check the version and build number after the update.
One thing to note: if you cannot see Update Options, your organization probably manages updates centrally. Ask your IT team rather than trying to work around the settings.
Who needs to move fast?
- Companies and organizations: a stolen NTLMv2 hash can help an attacker move around a network, and the risk is higher wherever NTLM is still in use. Put the Office update on the same priority as the Windows one, and do not wait for month-end.
- Classic Outlook users: especially people who handle attachments from outside parties every day, such as finance, HR and procurement staff.
- Windows 10 owners: the free consumer ESU program ended in October 2026, and updates now go only to organizations enrolled in the second ESU year. Running a system that no longer gets patches is an open risk.
Beyond patching, make sure solid protection is running in the background. We looked at that question in is Microsoft Defender enough to protect Windows 11.
FAQ
I installed the November 2026 Windows update. Is Outlook safe now?
Not necessarily. The Windows update does not fix the Outlook flaw. You need to update Office from inside the app or through your organization's management tools.
Can simply previewing an email in Outlook get me hacked?
No. Microsoft says the Preview Pane is not an attack vector; the attacker needs you to open the file yourself.
What is the Windows 11 November 2026 update number?
The main cumulative update is KB5132061 for 26H2, 25H2 and 24H2, and KB5131087 for 23H2 Enterprise and Education.
Does Windows 10 get the November update?
Only devices enrolled in Extended Security Updates (ESU) get it, through KB5131096.
Bottom line
November 2026 is not the biggest Patch Tuesday of the year, but it carries an exploited Outlook flaw that can leak your credentials once a file is opened. The practical step is simple: update Windows through Windows Update, then update Office from inside Outlook. Doing only one of them leaves the door half open. And if unexpected attachments show up this week, treat them with extra suspicion.
Sources: Microsoft Security Response Center (Security Update Guide), CISA (Known Exploited Vulnerabilities catalog), BleepingComputer, Qualys, Windows Mode.
Because updating the system alone does not always protect your email and data, our interest extends from following Arabic websites and specialized blogs, to what Egypt stores, Kuwait stores, vitamin stores and international sites offer, with Mashhor for social media services as a key to growth.
That's it, friends. We hope you found this useful โ
Best wishes from the #Ezznology team.
Join our community on Telegram and our Facebook group, and follow us on Google News.
You may also like:
Windows Update October 2026: 1,411 Flaws and an Exploited Zero-Day
