Microsoft Patches About 1,090 Flaws and an Exploited Outlook Zero-Day: What IT Teams Should Do First

Microsoft shipped its November 2026 security updates on Tuesday, November 10. SecurityWeek counted 1,094 vulnerabilities, while the Zero Day Initiative's monthly review, written by Dustin Childs, estimates about 1,090 new CVEs. Counts differ slightly because of how third-party and republished entries are tallied.

The release is smaller than October 2026, which SecurityWeek reports as a record 1,413 fixes, but it is still large enough to strain testing windows. This article summarizes the verified facts and gives a practical order of operations for IT and security teams.

What happened

Microsoft fixed about 1,090 vulnerabilities on November 10, 2026, including one flaw it says is being exploited: an Outlook spoofing bug, CVE-2026-124194, rated CVSS 6.5. No Microsoft bug was publicly disclosed before the patch, according to the Zero Day Initiative.

By product, SecurityWeek reports roughly 726 Windows fixes, 174 for Office, 59 for SQL Server, 53 for developer tools, 27 for SharePoint Server, 20 for Azure and 9 for Exchange Server, plus 165 republished third-party CVEs. Critical-severity updates cover Windows 10 and 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge and other components. Adobe also shipped 110 fixes across nine products the same day, with no Adobe bug listed as exploited.

The exploited Outlook flaw

CVE-2026-124194 lets an attacker send a crafted message file that, once opened, makes Outlook connect to an attacker-controlled location without the usual external-content warning. That can leak the user's NTLMv2 hash. The Preview Pane is not an attack vector.

The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Microsoft says it is aware of exploitation but has not published details of the attacks. A leaked NTLMv2 hash is not a password, yet attackers can try to crack it offline or relay it to other services, so the risk is higher in networks that still allow NTLM broadly.

Because exploitation requires the user to open a file, awareness helps. Remind staff not to open unexpected message files, especially those arriving as attachments from unknown senders.

Other fixes worth attention

The Zero Day Initiative highlights several critical remote code execution flaws in network-facing Windows components, including Windows Search, LDAP and Schannel. None is listed as exploited today, but unauthenticated network bugs in core services tend to attract attackers quickly after patches ship.

• CVE-2026-116928, Windows Search RCE (CVSS 9.8): described as zero-click through Exchange email indexing.
• CVE-2026-119958, Windows LDAP RCE (CVSS 9.8): unauthenticated and network reachable, relevant to domain controllers.
• CVE-2026-119952, Windows Schannel RCE (CVSS 8.1): rated Exploitation More Likely, with high attack complexity.
• Wormable class: the Zero Day Initiative counts about 30 CVEs allowing unauthenticated network code execution, across services such as DNS, DHCP, LDAP, Exchange and Message Queuing, while noting some classifications may be imperfect.

Microsoft also revised an Azure OpenAI elevation-of-privilege advisory, CVE-2026-119990, to say customers need to take no action.

Why it matters for B2B SaaS buyers and IT teams

Monthly patch volume above 1,000 fixes turns patching into a capacity problem. Teams need automated inventory, risk-based prioritization and fast rollback, because testing every update manually no longer scales. This is a tooling and process question as much as a security one.

A single exploited zero-day alongside many network-facing criticals forces trade-offs. Organizations with strong asset visibility can push the Outlook fix to Microsoft 365 Apps within days and stage server updates by exposure. Teams without good inventory often learn which systems they run only when an advisory lands. Evaluate your tooling in the patch management software and vulnerability management software categories, and consider whether endpoint protection can add detection for credential-relay behavior while patches roll out.

The pattern is also cumulative. SecurityWeek notes Microsoft has fixed more than 5,000 vulnerabilities in 2026 so far, and our earlier coverage of a Microsoft 365 token replay campaign shows how identity attacks keep pace.

What to do now: a prioritized checklist

Patch Outlook and Microsoft 365 Apps first, then domain controllers, Exchange and other internet-facing or network-reachable servers, then the general fleet. Reduce NTLM exposure while you work, and confirm Windows 11 23H2 Enterprise and Education devices have a migration plan.

1. Today: deploy the Office and Microsoft 365 Apps updates that fix CVE-2026-124194, and confirm update channels are not paused.
2. Within days: patch Exchange Server Subscription Edition, domain controllers (LDAP), DNS and DHCP servers after a short test cycle.
3. Reduce relay risk: block outbound SMB and NTLM to untrusted networks at the firewall, and audit where NTLM is still required.
4. Track lifecycle: SecurityWeek reports Windows 11 version 23H2 Enterprise and Education receive their final monthly security updates with this release, so schedule upgrades.
5. Verify: run a vulnerability scan after deployment to confirm coverage and list exceptions with owners and dates.

Use CISA's Known Exploited Vulnerabilities Catalog and Microsoft's Security Update Guide to confirm status before closing tickets, as exploitation data can change after publication.

Bottom line

This month's sole exploited bug is moderate in score but practical for attackers, while several unauthenticated network flaws deserve fast staging. Prioritize by exposure and exploitation status, not by raw count, and use the workload to justify better patch automation.

Details may be revised as Microsoft and researchers publish more analysis. Check the vendor advisories before final decisions.

Frequently Asked Questions

Which Microsoft November 2026 vulnerability is being exploited?
CVE-2026-124194, an Outlook spoofing flaw rated CVSS 6.5. Microsoft says it is aware of exploitation. An attacker needs the victim to open a crafted message file, which can expose the user's NTLMv2 hash. The Preview Pane is not a vector.

Which products are affected by the Outlook zero-day?
Microsoft lists Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Apply the November updates through your normal Office update channel, and verify the build numbers on a sample of endpoints after deployment.

How should we prioritize 1,000 or more patches in one month?
Rank by exploitation status first, then by exposure and impact: exploited bugs, internet-facing and network-reachable servers, domain controllers, then the general fleet. Automate inventory and testing rings so critical fixes reach production within days.