{"id":720,"date":"2026-11-13T10:48:37","date_gmt":"2026-11-13T10:48:37","guid":{"rendered":"https:\/\/mosravo.com\/publications\/?p=720"},"modified":"2026-11-13T11:15:24","modified_gmt":"2026-11-13T11:15:24","slug":"outlook-zero-day-leads-microsofts-1000-november-fixes-patch-now","status":"publish","type":"post","link":"https:\/\/mosravo.com\/publications\/2026\/11\/13\/outlook-zero-day-leads-microsofts-1000-november-fixes-patch-now\/","title":{"rendered":"Outlook Zero-Day Leads Microsoft&#8217;s 1,000+ November Fixes: Patch Now"},"content":{"rendered":"<body><p>Microsoft released its November 2026 security updates on Tuesday, 10 November, and once again the numbers are enormous. Depending on how you count, the release fixes roughly 1,100 vulnerabilities across Windows, Office, SQL Server, SharePoint and Exchange. Only one of them is confirmed as already being used in attacks, and it sits in a place almost every office relies on: classic Outlook.<\/p>\n<p>This article is for business owners, IT administrators and everyday Windows and Microsoft 365 users who want to know what to install first and why one important fix will not arrive through Windows Update alone.<\/p>\n<h2>What Microsoft fixed this month<\/h2>\n<p>Security trackers report slightly different totals (1,092, 1,093 and 1,094 are all being quoted, and BleepingComputer counted more when it included other fixes), because counting methods differ. Using the widely cited figure of 1,093 new vulnerabilities:<\/p>\n<ul>\n<li><strong>63 are rated Critical<\/strong>, 1,029 Important and one Moderate.<\/li>\n<li><strong>535 are elevation of privilege<\/strong> flaws, which let an attacker who already has a foothold gain more control.<\/li>\n<li><strong>296 allow remote code execution<\/strong>, meaning an attacker could run their own code on a target system.<\/li>\n<li>By product, Windows accounts for 733 fixes, Office 174, SQL Server 52, SharePoint Server 27 and Exchange Server 9, according to IT-Connect.<\/li>\n<\/ul>\n<p>This is the second-largest Patch Tuesday on record, behind October\u2019s 1,407 fixes. Large monthly totals are becoming the norm, which makes prioritising more important than ever.<\/p>\n<h2>The exploited Outlook flaw: CVE-2026-124194<\/h2>\n<p>The zero-day is tracked as <strong>CVE-2026-124194<\/strong>, a spoofing vulnerability in classic Outlook. Microsoft rates it only Moderate, with a CVSS score of 6.5, but it is the one attackers are already using.<\/p>\n<h3>How the attack works<\/h3>\n<ol>\n<li>An attacker sends the victim a specially crafted message file.<\/li>\n<li>The victim opens the file.<\/li>\n<li>Outlook connects to a network location the attacker controls, without showing the usual warning about external content.<\/li>\n<li>That connection can leak the user\u2019s NTLMv2 authentication hash. Attackers can try to crack the hash offline or use it in relay attacks to impersonate the user.<\/li>\n<\/ol>\n<p>The attack needs the user to open the file and needs network connectivity. Microsoft says the Preview Pane is not an attack vector for this particular flaw. It has confirmed exploitation but has not said who is behind it or how widespread it is. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalogue on 10 November and gave federal agencies until 24 November to fix it.<\/p>\n<h3>Who is affected<\/h3>\n<p>Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. IT-Connect lists the fixed builds as 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024.<\/p>\n<h2>Why Windows Update alone is not enough<\/h2>\n<p>The Outlook fix ships through Office\u2019s own update channel. A computer that shows Windows as fully up to date can still be running a vulnerable copy of Outlook. Do not assume Office updated itself in the background; check it.<\/p>\n<p>For the Windows side, the main cumulative updates this month are:<\/p>\n<ul>\n<li><strong>KB5132061<\/strong> for Windows 11 24H2, 25H2 and 26H2<\/li>\n<li><strong>KB5132059<\/strong> for Windows 11 26H1<\/li>\n<li><strong>KB5131087<\/strong> for Windows 11 23H2<\/li>\n<li><strong>KB5131096<\/strong> for Windows 10 21H2 and 22H2 (LTSC editions and machines enrolled in Extended Security Updates)<\/li>\n<\/ul>\n<h2>Other critical flaws worth your attention<\/h2>\n<p>None of these is marked as exploited yet, but several are serious enough to move to the front of the queue for organisations running Windows servers:<\/p>\n<ul>\n<li><strong>Three critical Outlook remote code execution flaws<\/strong> (CVE-2026-110043, CVE-2026-110068 and CVE-2026-111309), which IT-Connect says can be triggered just by displaying a malicious email in the reading pane.<\/li>\n<li><strong>Windows LDAP (CVE-2026-119958)<\/strong>, rated 9.8 out of 10, allowing unauthenticated code execution on domain controllers.<\/li>\n<li><strong>Active Directory Domain Services<\/strong> (CVE-2026-118146 and CVE-2026-118148), which Microsoft rates as \u201cexploitation more likely\u201d.<\/li>\n<li><strong>Windows Search (CVE-2026-116928)<\/strong>, rated 9.8, which can be triggered by an email attachment that Exchange indexes automatically. The fix is in Windows, not Exchange.<\/li>\n<li><strong>Exchange Server (CVE-2026-118207)<\/strong>, fixed for Exchange Subscription Edition in KB5133453.<\/li>\n<li><strong>Schannel (CVE-2026-119952)<\/strong>, a pre-authentication flaw in Windows\u2019 TLS component that depends on specific configurations.<\/li>\n<li><strong>Eight Hyper-V privilege escalation flaws<\/strong>, including one that could allow a virtual machine escape.<\/li>\n<\/ul>\n<p>Exchange 2016 and 2019 are not in this month\u2019s list because their extended security update programme ended in October 2026. They are still exposed, so organisations still running them should plan a move to a supported version or to a hosted service.<\/p>\n<h2>What this means for Nigerian and African businesses<\/h2>\n<p>Many small offices across the region run classic Outlook on shared PCs and keep older Exchange servers going long past their support dates. That combination is exactly what this month\u2019s release targets. An NTLM hash stolen from one staff member can become a way into shared drives and email for the whole office. Patching quickly, and replacing unsupported servers, is far cheaper than recovering from a compromised mailbox used to send fake invoices to your customers.<\/p>\n<h2>What you should do<\/h2>\n<ol>\n<li><strong>Update Office on every PC that runs Outlook.<\/strong> In Outlook or Word, go to <em>File &gt; Account &gt; Update Options &gt; Update Now<\/em>, then restart Office when asked.<\/li>\n<li><strong>Run Windows Update separately<\/strong> and restart to install this month\u2019s cumulative update.<\/li>\n<li><strong>Administrators:<\/strong> list every device running classic Outlook, push the November Office update through Intune, Configuration Manager or your usual tool, and confirm devices reached the fixed build.<\/li>\n<li><strong>Patch servers in order:<\/strong> domain controllers, then Exchange hosts (Windows update plus KB5133453), then Hyper-V hosts.<\/li>\n<li><strong>Warn staff<\/strong> not to open unexpected message-file attachments. This is an extra layer, not a replacement for patching.<\/li>\n<li><strong>Back up before patching<\/strong> critical servers so you can recover if an update causes problems.<\/li>\n<\/ol>\n<h3>Sources<\/h3>\n<ul>\n<li><a href=\"https:\/\/cybersecuritynews.com\/microsoft-november-2026-patch-tuesday\/\" target=\"_blank\" rel=\"noopener nofollow\">Cyber Security News: Microsoft November 2026 Patch Tuesday fixes 1,093 vulnerabilities<\/a><\/li>\n<li><a href=\"https:\/\/www.it-connect.tech\/patch-tuesday-november-2026-microsoft-fixes-1093-vulnerabilities-including-an-exploited-outlook-zero-day\/\" target=\"_blank\" rel=\"noopener nofollow\">IT-Connect: Patch Tuesday November 2026<\/a><\/li>\n<li><a href=\"https:\/\/windowsforum.com\/news\/november-2026-patch-tuesday-exploited-outlook-zero-day-requires-office-update.451775\/\" target=\"_blank\" rel=\"noopener nofollow\">WindowsForum: Exploited Outlook zero-day requires Office update<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/microsoft\/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day\/\" target=\"_blank\" rel=\"noopener nofollow\">BleepingComputer: Microsoft November 2026 Patch Tuesday<\/a><\/li>\n<\/ul>\n<\/body>","protected":false},"excerpt":{"rendered":"<p>Microsoft&#8217;s November 2026 Patch Tuesday fixes about 1,100 flaws, including an Outlook spoofing bug already used in attacks. The fix comes through Office updates, not just Windows Update.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[5,10],"tags":[122,438,439,22,54,26],"class_list":["post-720","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","category-news","tag-microsoft-365","tag-microsoft-outlook","tag-ntlm","tag-patch-tuesday","tag-windows-update","tag-zero-day"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/posts\/720","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/comments?post=720"}],"version-history":[{"count":3,"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/posts\/720\/revisions"}],"predecessor-version":[{"id":791,"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/posts\/720\/revisions\/791"}],"wp:attachment":[{"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/media?parent=720"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/categories?post=720"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/tags?post=720"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}