Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day

Microsoft released its November 2026 security updates on November 10, fixing 1,235 flaws across its product line, according to BleepingComputer. The release marks the second consecutive month Microsoft has addressed more than 1,000 vulnerabilities, with The Record noting the October update fixed over 1,100 CVEs. Four specific vulnerabilities drew particular attention from Rescana: three critical remote code execution (RCE) bugs in Windows Search (CVE-2026-116928), Windows LDAP (CVE-2026-119958), and Windows Schannel (CVE-2026-119952), plus an exploited Outlook spoofing vulnerability (CVE-2026-124194).

The Windows Search and LDAP flaws both carry a CVSS 3.1 score of 9.8 (Critical), allowing unauthenticated attackers to execute code over the network without user interaction. The Schannel vulnerability scores 8.1 (High) due to high attack complexity, though Microsoft assigns it a vendor severity of Critical. Microsoft's exploitability assessments rate the Search and LDAP bugs as "Exploitation Less Likely" and the Schannel flaw as "Exploitation More Likely." The Zero Day Initiative characterized the Search bug as "a zero-click code execution bug on a high-value target" and noted the LDAP issue "could be quite destructive, especially on Domain Controllers."

The Outlook spoofing flaw (CVE-2026-124194) is rated Moderate at 6.5 CVSS but is the only one of the four marked as exploited by Microsoft and listed in CISA's Known Exploited Vulnerabilities catalog as of November 10, with a due date of November 24 for federal agencies. Microsoft says an attacker could send a crafted message file that, when opened, causes Outlook to connect to an attacker-controlled location without the usual external-content warning, disclosing the user's NTLMv2 hash. Microsoft states the Preview Pane is not an attack vector.

The three RCEs affect Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2016 through 2025, with fixes delivered via November 2026 cumulative updates and hotpatches (multiple KBs listed). The Outlook fix applies to Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 via Microsoft 365 Apps security updates.

Microsoft's Windows Blog and BigGo Finance highlight an AI-driven "patch gap" problem: diagnostic data from August 2026 shows fewer than half of corporate Windows devices installed security updates within two weeks, and roughly one in four remained unpatched after four weeks. Microsoft warns AI can shrink exploit development to "within hours" of patch release. The company urges immediate updating, adoption of supported versions, use of Windows Autopatch and hotpatching (available on Windows 11 and Windows Server 2025 in eligible Azure-connected environments), and prioritization of internet-exposed and critical authentication systems. Microsoft's MDASH AI code scanner and AI-assisted remediation processes are driving the increased vulnerability discovery and fix rates, which Microsoft says reflect more thorough coverage, not decreased security.