Microsoft's November Patch Tuesday Fixes Over 1,000 Flaws, Including an Outlook Zero-Day
Another enormous monthly update from Microsoft includes a spoofing bug in Outlook that attackers were already exploiting. Here is what to install.
Microsoft released its November 2026 Patch Tuesday updates on November 10, and once again the numbers are huge. Security outlets counted more than 1,000 vulnerabilities fixed across Windows, Office and other Microsoft products. SecurityWeek tallied 1,094 while other trackers landed on 1,093, since counts vary depending on which advisories are included.
That follows October, when Microsoft set a record with 1,413 fixes in a single month. Much of the recent jump comes from Microsoft folding more cloud and third-party component advisories into its monthly releases.
The bug that matters most
The headline issue is an Outlook spoofing vulnerability, CVE-2026-124194, which Microsoft says was exploited in the wild before a fix was available. Spoofing flaws let attackers make malicious content look like it came from a trusted source, which is a natural fit for phishing campaigns.
One important detail: this fix ships through the Office and Microsoft 365 update channel, not through Windows Update alone. Installing the Windows update will not protect you if your Office apps are out of date.
What to do
- On Windows 11, install the November cumulative update, KB5132061, from Settings, then Windows Update.
- Open any Office app, go to File, then Account, then Update Options, and choose Update Now.
- IT teams should prioritize the Outlook fix on any machine that handles external email.
Some PCs have had trouble installing this month's Windows update. See our separate story on the KB5132061 install failures if you hit an error.
Sources
This story is based on reporting and official statements from:
Details were accurate when published on November 11, 2026. Found an error? Email [email protected].
