Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day

Microsoft released its November 2026 Patch Tuesday security updates today, addressing a record-breaking 1,235 flaws. The updates include a fix for one Microsoft Outlook zero-day vulnerability that was actively exploited in attacks.

Of the 1,235 vulnerabilities, 66 are rated Critical. Forty-eight of the Critical flaws are Remote Code Execution issues, 15 are Elevation of Privilege flaws, and three are Use-After-Free vulnerabilities in Microsoft Edge. Approximately 639 of the total vulnerabilities fall under Windows or Microsoft Windows products and components.

The actively exploited flaw is a Microsoft Outlook Spoofing zero-day that attackers used to steal NTLM account hashes. According to Microsoft, an unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without showing the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Microsoft says exploitation requires network connectivity and user interaction.

The flaw is a type of NTLM credential disclosure vulnerability. When a malicious attachment is opened, Windows may automatically attempt to authenticate to an attacker-controlled network share, exposing the user's NTLMv2 authentication hash. An attacker could capture that hash and potentially crack it offline, then use the recovered credentials to gain unauthorized access to corporate accounts. Similar vulnerabilities have been exploited in the past, typically through malicious attachments sent in phishing campaigns.

The November total counts only vulnerabilities Microsoft released on Patch Tuesday itself. It excludes 108 flaws fixed earlier this month, including one Entra Device Registration flaw, 82 Mariner flaws, and 25 Microsoft Edge flaws.

The release follows October's updates, which addressed a record-breaking 1,411 flaws, as Microsoft continues to use AI to find and patch vulnerabilities. Microsoft also released non-security updates today, including the Windows 11 KB5132061 and KB5131087 cumulative updates and the Windows 10 KB5131096 extended security update. Other vendors released updates or advisories in November 2026 as well.

More cybersecurity news from TechManNews.