# Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day

> **Open Intelligence Dossier** · First detected: 2026-11-10 21:00 UTC · Category: Technology

## Executive Summary
Microsoft's November 2026 Patch Tuesday addresses 1,235 vulnerabilities, including three critical remote code execution flaws and an actively exploited Outlook spoofing bug.

## Intelligence Brief
Microsoft released its November 2026 security updates on November 10, fixing 1,235 flaws across its product line, according to BleepingComputer. The release marks the second consecutive month Microsoft has addressed more than 1,000 vulnerabilities, with The Record noting the October update fixed over 1,100 CVEs. Four specific vulnerabilities drew particular attention from Rescana: three critical remote code execution (RCE) bugs in Windows Search (CVE-2026-116928), Windows LDAP (CVE-2026-119958), and Windows Schannel (CVE-2026-119952), plus an exploited Outlook spoofing vulnerability (CVE-2026-124194).


The Windows Search and LDAP flaws both carry a CVSS 3.1 score of 9.8 (Critical), allowing unauthenticated attackers to execute code over the network without user interaction. The Schannel vulnerability scores 8.1 (High) due to high attack complexity, though Microsoft assigns it a vendor severity of Critical. Microsoft's exploitability assessments rate the Search and LDAP bugs as "Exploitation Less Likely" and the Schannel flaw as "Exploitation More Likely." The Zero Day Initiative characterized the Search bug as "a zero-click code execution bug on a high-value target" and noted the LDAP issue "could be quite destructive, especially on Domain Controllers."


The Outlook spoofing flaw (CVE-2026-124194) is rated Moderate at 6.5 CVSS but is the only one of the four marked as exploited by Microsoft and listed in CISA's Known Exploited Vulnerabilities catalog as of November 10, with a due date of November 24 for federal agencies. Microsoft says an attacker could send a crafted message file that, when opened, causes Outlook to connect to an attacker-controlled location without the usual external-content warning, disclosing the user's NTLMv2 hash. Microsoft states the Preview Pane is not an attack vector.


The three RCEs affect Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2016 through 2025, with fixes delivered via November 2026 cumulative updates and hotpatches (multiple KBs listed). The Outlook fix applies to Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 via Microsoft 365 Apps security updates.


Microsoft's Windows Blog and BigGo Finance highlight an AI-driven "patch gap" problem: diagnostic data from August 2026 shows fewer than half of corporate Windows devices installed security updates within two weeks, and roughly one in four remained unpatched after four weeks. Microsoft warns AI can shrink exploit development to "within hours" of patch release. The company urges immediate updating, adoption of supported versions, use of Windows Autopatch and hotpatching (available on Windows 11 and Windows Server 2025 in eligible Azure-connected environments), and prioritization of internet-exposed and critical authentication systems. Microsoft's MDASH AI code scanner and AI-assisted remediation processes are driving the increased vulnerability discovery and fix rates, which Microsoft says reflect more thorough coverage, not decreased security.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| SecurityWeek | Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft | [Source Link](https://news.google.com/rss/articles/CBMimgFBVV95cUxONmpKRUg4TkR2ZnBwU1RzV0YxUW5VYkFZTThBdFhiZDlpT2R2Y1BlZURScDBNM1pyTjhXT2dzZTJoX3FLTDAyY2JZNFlyYXJVbFFHTTJ1U29YdTVwU09oYVJvTU42UnpWc1ZES2Vjc2JkNzBwQlpVdVF2VHVMd09UeHp0M0YwU0UyRy11bXNPWFB2aXptTTNNX2tR?oc=5) |
| Dark Reading | November Patch Tuesday Offers an Overflowing Cornucopia of CVEs | [Source Link](https://news.google.com/rss/articles/CBMilAFBVV95cUxPc1VzeXNPUTNVWXR2amNSWTVQZTFiX0JjaHllbGYxVTJaZGxGTTl1YzRaWFJxUnprU1RxLUpYZlM2cHBuWm1vSENOd3Y3M096NUhMUU12U0JYc0FkallKMHFaQjBjcVpyNnlGT2NiNDhDal9ZOEx4V196eGJTbnI0eTVyTUtCd0FLX1U1c3FmdTRtcy1m?oc=5) |
| Neowin | Microsoft releases Patch Tuesday update KB5131096 for Windows 10 22H2 and 21H2 | [Source Link](https://news.google.com/rss/articles/CBMiqwFBVV95cUxOSUpWc0pxVDJacEVjU3VVWWswNTRjQlUxdnlDeW9FMDAtR0U3U3JCU3VuSVc2VFdjbnFhMGZjNUNmRVFmTlFEV3FRWDJYU3JCWHZEYU9OWUFSeGw0SkZZZG5VblVjdHB5U0pnVWRWN2JBQU5oNUs1M0ZCSEJkZjNpanotY2tCT015Ti1WUmZoVGVNU2RMY1lVZEtYOGxOY1RjQ1hlSUhFWEN1eXc?oc=5) |
| Krebs on Security | Microsoft Fixes Nearly 1,100 Security Vulnerabilities | [Source Link](https://news.google.com/rss/articles/CBMikwFBVV95cUxOZTEwcGk1aFgtYVd0anRBbHdibDNVd05ESnItLUdTbDdUM0hSN0tuaDR5OFM3WUV4RFpRUjFrSlhqU3hSdm9ESUFxMnN0Y291b3hGYnN2WmpMU0M3VzZIOXZKWnE1WUxCU1NhZmhUWUlOTE10ZG1OMHpISjVuOEIzaVFkZ1JGME9iRjJUcTZGbWpiRTQ?oc=5) |
| CyberScoop | Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday | [Source Link](https://news.google.com/rss/articles/CBMibkFVX3lxTE80cWhxZUphNm9ma0ljdzZyM1preHIySTdQU0h1WENuOVhPYWF3c1ZaOVV2V0NyQjh0djFFZUR2UlUwT25wdkI0V0VFb21nbUotUUU4NXZSOVdpNzFKZTZUdWh5d0E4ZTF0U3Z5U1RB?oc=5) |
| BleepingComputer | Microsoft releases Windows 10 KB5131096 extended security update | [Source Link](https://news.google.com/rss/articles/CBMiswFBVV95cUxPV1JmaFMtQndCa1dEZXVIWEwxOF9PNGdJUmxjTFBLdzBCNkRwam85bnlVUlh1ZGU3a2xKWGRsUk5TR1JIbWhDSG1laUVXTmZCT2gycDd4TGZ1MU1BdF8wM3JFOW5rbUZUbU81MEF2d1lsaWVmTFFmS2R0N1c5eVIyQ0h0dEhqc2M1MFprdUhVenBvNEVvZjV0eDdmMXJOS014M1lBLW04N3B6ZVUzV0QySnYxUQ?oc=5) |
| Rescana | Microsoft November 2026 Patch Tuesday: Windows Search, LDAP, and Schannel RCEs, and an Exploited Outlook Spoofing Flaw — Prepare Now | [Source Link](https://news.google.com/rss/articles/CBMipAFBVV95cUxNZ3FkX1E5ejkxLWtERE52TFZpNW1xaEFlWEkxWUdlSEdNNkh6VUlzdWF2UkZ2bHpONUNBdDhvNFFlbE02bjJMeVk1b3FpLUNWemR4ZXB4LUJmVnV4UVFqMEEyS2V4bmJSYldrTWJRSGlTZUhuVGdyMjM1M0pfUWRRQVJXZUFWV0ZpeUNYZ213OUNjSm01azRJZHhrZDVwUk5xQ2xzeQ?oc=5) |
| The Record from Recorded Future News | Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row | [Source Link](https://news.google.com/rss/articles/CBMicEFVX3lxTE1zbjFHQnhqMWZVaHBMRHNXaExMeVlPc3JSQU5xcmtDUEdQNm1DalNmalFRSmR1MGhQSjZYMFZiX2xCU3FHdUhUdzVGR3hlWjdULVhFTmR1OFI5b3dYVjhuMHRiQVpUbl9OS0lCdkJNYXA?oc=5) |
| BigGo Finance | Microsoft Warns of AI-Era "Patch Gap" as a Quarter of Corporate Devices Remain Unpatched a Month Later | [Source Link](https://news.google.com/rss/articles/CBMidkFVX3lxTE5UenM5MjRDMU1pekI2MFZ4azZzM2JjTUZXdV9SWDV1RE96ZDB5RGRobExpRjhSa2FnYUxBU2lNcUhlMjdlbXNjQmJXMTI0SHYzeWNLb3hsaTljYlU4Um1vTXJETzM4SE03X2V3c0hRTzlpaEdETVE?oc=5) |
| Help Net Security | November 2026 Patch Tuesday forecast: Old software continues to bite | [Source Link](https://news.google.com/rss/articles/CBMihwFBVV95cUxNb2RTSExBS2ZWWlhDLU8wMGFnMXVmblEwbmZvTVF4TWI2X2tWYzFjUTlxTTk2OXhRSGlncV9MYmhFUE9PT0tjLUpGeG5PS0lPZWpVSnNIRUJDa2VfMVZfWk5fc2tSUU8tZkxlXzZYaWZuR0FsMzlITjl1d3Q0Tk5YMWU1RGQzWlk?oc=5) |
| Foro3D | Microsoft closes 1,413 vulnerabilities and accelerates patching with AI | [Source Link](https://news.google.com/rss/articles/CBMirAFBVV95cUxOZUI1cXBBaWZYalRHaFM0bDBDeTFoNWhpam4zX1VWcWhYVTZLd3lPMzlvLV9keHpTYmhEM0FZVDZOeTdXQU5WNllmcXdoZWZ0MjlKQzQ0MGdja3gzbThKY0NuTXM0ekNGTXNWTk82WWJrS3dKVm4zQUlwM3ZZWlgtZzg4T0RReEVjVzhsUzVqM3BsSG1mU2hKaUdUSnhwXy1LMGFxTEVGQkc1dkFq?oc=5) |
| Windows Blog | A new standard for vulnerability management in the AI era | [Source Link](https://news.google.com/rss/articles/CBMiswFBVV95cUxPc3cydTdzRUVHUG1acjNkRVk5MExoQ3l4RTZMQ2ZQNU4tT3hPdjZNVFpoZmxIZGhxeXZvVWdySmhUREUyQkl4OUd5UVhIa2hpcW5fU3ZsdGtaUzhoQXpwLVRKWGViSzVCaU5aZDJGZDg1ZDFNWk5VbGRWemtYdE9sVnNMcDRUNEJGaGwyY29KV2FyWmNmY0tBTWRDdW82NUpOMWdORzNYV0FMQUk0RnhKVTlRUQ?oc=5) |
| BleepingComputer | Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day | [Source Link](https://news.google.com/rss/articles/CBMivgFBVV95cUxQUW5MOWdTMklESkxEYTVWSFV1enJ0ZF9JNGFSOG03UjQzelY4WVBrdWo5SGJZd1BrU0NweXVUcm1jWmExNFl6TmcyLXUxc3FpUlpsLU9UYmtJdE9RWjBmZXZoTXpzS08xNmI5Sjk5bm5rRTZZV2tINU5oaHVETkhVNEdZVlM5bXpzY0RfRFpleWNvQ1kxQ2V1SXQ2WHNScllpTjFMR0p2ZjhsaVpjVjYta3NHREIzS18zUVlPT3Zn?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-11-10/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day*