November 2026 Patch Tuesday: Outlook Zero-Day, KB5132061 and Should You Update?

Last updated: November 11, 2026. By Veer. Facts checked against Microsoft’s November 2026 Security Update Guide release notes and CVRF data, the CVE-2026-124194 advisory, KB5132061, KB5131096, Windows 11 release information, CISA’s Known Exploited Vulnerabilities catalog, and reporting from BleepingComputer, the Zero Day Initiative, Krebs on Security, SecurityWeek and CSO Online. This is a researched news explainer, not a lab test.

If your PC asked to restart this morning, this is why. November’s update is smaller than October’s record release, but it still runs to four digits, and one of the bugs is already being used in attacks. Here’s what the November 2026 Patch Tuesday fixes, which KB number your PC should get, what’s still broken, and how to install it.

What is in the November 2026 Patch Tuesday?

The November 2026 Patch Tuesday, released on November 10, 2026, fixes about 1,100 vulnerabilities across Windows, Office, Exchange Server, SharePoint, SQL Server, .NET and Azure. It includes one actively exploited zero-day (in Outlook) and no publicly disclosed ones. Microsoft published it at about 10 a.m. Pacific time, which was 11:30 p.m. in India and 6 p.m. in the UK.

It is smaller than October, when Microsoft shipped more than 1,400 fixes. The Zero Day Initiative put it plainly: “at least it’s not a new record for Microsoft.” Even so, SecurityWeek notes Microsoft has now fixed more than 5,000 vulnerabilities in 2026, and Krebs on Security says that’s “a staggering number considering that a year ago Microsoft was averaging around 100 patches per month.” Microsoft credits AI-assisted bug hunting for the jump.

Trackers count the total differently, so here are the main numbers side by side:

By type, Microsoft’s data shows 534 elevation-of-privilege bugs, 297 remote code execution bugs, 157 information disclosure bugs, 46 denial-of-service bugs, 27 security feature bypasses, 22 spoofing bugs and 11 tampering bugs. By product, SecurityWeek counts 726 in Windows, 174 in Office, 59 in SQL Server, 27 in SharePoint Server, 20 in Azure and 9 in Exchange Server.

Which zero-day is being exploited (CVE-2026-124194)?

CVE-2026-124194 is a spoofing flaw in classic Outlook for Windows that Microsoft says is being exploited in attacks. Opening a specially crafted message file makes Outlook connect to an attacker’s server without showing its usual external-content warning, which hands the attacker your NTLMv2 password hash.

Microsoft’s advisory says: “An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user.”

What matters for you:

• It needs you to open a file. Microsoft says the Preview Pane is not an attack vector, so just seeing the message in your inbox isn’t enough.
• The score undersells it. Microsoft rates it only Moderate (CVSS 6.5). The stolen hash can be relayed to sign in as you or cracked offline to recover your password, Rapid7 and CSO Online explain. “Don’t let the low score fool you,” Nightwing’s Nick Carroll told CSO.
• Affected products: Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 (32-bit and 64-bit), per Microsoft’s advisory.
• Fixed builds: Office LTSC 2021 version 16.0.14334.21048 and Office LTSC 2024 version 16.0.17932.21140. Microsoft 365 Apps get the fix through their normal update channel.
• Deadline: CISA added it to the KEV catalog on November 10, 2026, with a federal deadline of November 24, 2026.
• Who found it: Microsoft credits a researcher called “nono” and “Benoît Sevens using Claude with Anthropic.” A Tenable senior staff researcher told CSO that “for most of the year, AI has been building bigger haystacks across Patch Tuesday releases, and this appears to be the first time it has found a needle.”

Microsoft hasn’t said who is using the bug or against whom. BleepingComputer notes similar NTLM-leak bugs have been used in phishing campaigns before. The new Outlook for Windows and Outlook on the web aren’t listed as affected.

Which other November flaws matter most?

The most dangerous non-exploited bugs this month are “zero-click” server flaws: Windows Search via Exchange (CVE-2026-116928), Windows LDAP (CVE-2026-119958) and Windows Schannel (CVE-2026-119952). Home PCs are mostly covered by the normal Windows update; these matter most to businesses.

CVSS scores and severities from Microsoft’s November 2026 CVRF data; descriptions from the Zero Day Initiative and CSO Online.

ZDI counts 30 “wormable” bugs this month, down from 59 in October, including five in Message Queuing and four in Windows DNS. Office users also get more than a dozen Critical remote code execution fixes in Excel, Word, Outlook and PowerPoint, so the Office update matters even apart from the zero-day. One Critical Azure OpenAI bug (CVE-2026-119990, CVSS 9.8) is fixed by Microsoft on its side; ZDI notes the advisory was revised to say no customer action is needed.

Which KB number should my PC get?

Windows 11 25H2 and 26H2 get KB5132061 (builds 26200.9974 and 26300.9974). Windows 10 PCs enrolled in Extended Security Updates get KB5131096 (build 19045.7846). Here is every version:

Builds and KB numbers from Microsoft’s Windows 11 and Windows 10 release information pages, updated November 10, 2026.

To check your version, press Windows + R, type winver and press Enter. If you’re on Windows 11 24H2 Home or Pro, you won’t be offered KB5132061 at all. You need to move to 25H2 or 26H2 to keep getting fixes like this one. Our Windows 11 24H2 end of support guide explains how.

What does KB5132061 fix besides security?

Besides the security patches, KB5132061 fixes the USB Audio Class 1.0 “Code 10” bug, an Active Directory printer error and a Remote Desktop certificate problem. The full list from Microsoft’s KB5132061 release notes:

• USB audio fixed. Some USB Audio Class 1.0 devices (older USB headsets, DACs and mixers) could fail with “This device cannot start (Code 10)” or play no sound after September’s update. Microsoft’s release health pages now mark this Resolved by KB5132061 on Windows 11 and KB5131096 on Windows 10.
• Printer error 87 fixed. Adding a printer published in Active Directory could fail with “The parameter is incorrect.” Microsoft says the October update caused it.
• Remote Desktop fixed. RDP connections could fail because of a certificate mismatch after the October preview update.
• NTLM signing on by default. Windows clients now offer NTLM message signing by default for non-anonymous connections, which Microsoft says reduces exposure to NTLM relay attacks. That’s directly relevant to this month’s Outlook zero-day.
• Stricter PowerShell signing. Signed scripts with invalid UTF-8 encoding may now fail signature checks. Microsoft’s fix: re-save them as UTF-8 with a byte order mark and sign them again.
• Secure Boot certificates. More PCs become eligible to receive the new Secure Boot certificates automatically.
• Cuba time zone. Daylight saving rules for Cuba are updated.

On 25H2 and 26H2, the update also rolls in the changes from October’s optional preview (KB5127936). BleepingComputer lists these as including a customizable right-click menu in File Explorer, a refreshed AutoPlay dialog with dark mode, and ~ support in the File Explorer address bar.

What known issues does the November update have?

Microsoft says it is “not currently aware of any issues” with KB5132061, and its Windows 11 25H2 and 26H2 release health pages show no open issues as of November 10. That’s a cleaner start than October.

Source: Microsoft’s Windows 11 26H2, 25H2 and Windows 10 22H2 release health pages, checked November 11, 2026.

Two notes for IT admins. The KB5131096 page for Windows 10 still shows the USB audio problem under “Known issues,” even though the Windows 10 release health page marks it resolved by that same update. And the PowerShell signing change above can break older signed scripts. Problems often surface a day or two after release, so we’ll update this section if Microsoft adds anything. For the October issues, see our Windows 11 26H2 known issues tracker.

Should you install the November 2026 update?

Yes. Install it this week, and update Microsoft Office at the same time. The Outlook zero-day is already in use, the Windows update has no known issues, and it fixes the USB audio bug that’s been around since September.

• Home users: Install the Windows update, then update Office (see below). If you don’t use classic Outlook, the Windows update still closes dozens of Critical bugs.
• Small businesses: Patch Outlook and Office first because of the zero-day. Then patch any Exchange servers and domain controllers, which ZDI and Action1 both put at the top of the server list.
• If you rely on signed PowerShell scripts: Test them on one machine first because of the stricter signing check.
• If you’re on Windows 11 24H2 Home/Pro or Windows 10 without ESU: You get nothing this month. Plan an upgrade now. Our Windows end of support calendar lists every deadline, and our Windows 10 ESU guide covers how to keep Windows 10 patched until October 2027.

Microsoft Defender’s built-in protection doesn’t replace patching. If you’re weighing whether you need more than Defender, see our look at whether Windows Defender is enough.

How do you install the November 2026 Patch Tuesday update?

Go to Start > Settings > Windows Update, click Check for updates, install KB5132061 (or KB5131096 on Windows 10 ESU) and restart. Most PCs will install it on their own within a few days.

1. Back up first. Krebs on Security’s standing advice is to back up important data before applying OS updates.
2. Windows: Open Settings > Windows Update > Check for updates. Install the November 2026 cumulative update and restart when asked.
3. Office / Outlook: Open any Office app, go to File > Account > Update Options > Update Now, per Microsoft’s Office update guide. Then check File > Account shows the fixed build (16.0.14334.21048 or later on LTSC 2021, 16.0.17932.21140 or later on LTSC 2024).
4. Manual download: IT admins can grab the standalone package from the Microsoft Update Catalog.
5. Confirm: Run winver and check the build matches the table above (for example, 26200.9974 on 25H2).

If the update fails, restart and check again, or install the standalone package from the Microsoft Update Catalog.

What else should you update this week?

Update Chrome right away: Google patched an exploited Chrome zero-day (CVE-2026-125350) on November 9. Several other vendors also shipped big fixes this week:

• Google Chrome: Chrome 157.0.8103.50/.51 on Windows and Mac (157.0.8103.50 on Linux and Android) fixes 9 flaws, including CVE-2026-125350, a use-after-free in Chrome’s XML component that “Google is aware… exists in the wild.” CISA added it to KEV on November 10 (deadline November 24). Details in our Chrome security update November 2026 guide.
• Microsoft Edge: On November 9, Microsoft said it is “aware of the recent exploits existing in the wild” and is “actively working on releasing a security fix.” Check edge://settings/help over the next few days.
• Firefox: Firefox 160 fixes almost 100 CVEs, about half high severity, per Krebs on Security.
• Adobe: 9 bulletins with 110 CVEs, led by Adobe Connect (24 CVEs, 18 Critical). Adobe says none are exploited, per ZDI.
• Apple: iOS 27.2.1 and macOS updates landed on November 9. See our iOS 27.2.1 update guide.

Is this the last update for Windows 11 23H2?

Yes. KB5131087 is the last security update for Windows 11 23H2 Enterprise and Education. Microsoft’s KB page says: “The November 2026 Windows security update is the last update available for these editions.” Home and Pro editions of 23H2 had already reached end of updates before this release.

The next Windows deadline is January 12, 2027, when free support ends for Windows 10 Enterprise LTSC 2021 and Windows Server 2016. Rapid7 also notes that .NET 8 and PowerShell 7.4 LTS have passed their end dates this month. Microsoft says there will be no December 2026 non-security preview update because of the holidays, so the next Windows update after this one is the December 8, 2026 Patch Tuesday.

Timeline: November 2026 Windows updates and deadlines

The dates that matter are November 10 (release), November 24 (CISA deadline for the Outlook and Chrome zero-days) and December 8, 2026 (next Patch Tuesday).

For last month’s details, see our October 2026 Patch Tuesday guide.

FAQ

When was the November 2026 Patch Tuesday?

Microsoft released the November 2026 Patch Tuesday updates on Tuesday, November 10, 2026, at about 10 a.m. Pacific time. The next Patch Tuesday is December 8, 2026.

How many vulnerabilities did the November 2026 Patch Tuesday fix?

About 1,100. Krebs on Security and our own count of Microsoft’s data both get 1,093 new Microsoft CVEs, with 63 rated Critical. SecurityWeek counts 1,094, and BleepingComputer counts 1,235 because it includes 142 Microsoft Edge flaws.

Is there a zero-day in the November 2026 Patch Tuesday?

Yes, one. CVE-2026-124194 is an Outlook spoofing flaw that leaks your NTLMv2 password hash when you open a crafted file. Microsoft says it is exploited, and CISA set a federal patch deadline of November 24, 2026.

What is KB5132061?

KB5132061 is the November 10, 2026 cumulative security update for Windows 11 25H2, 26H2 and 24H2 Enterprise/Education. It moves them to builds 26200.9974, 26300.9974 and 26100.9974 and fixes the USB audio Code 10 bug.

Is KB5132061 safe to install?

Microsoft says it is not aware of any issues with KB5132061, and its release health pages show no open issues for 25H2 or 26H2. Given the exploited Outlook zero-day, installing it this week is the safer choice for most people.

Does Windows 10 get the November 2026 update?

Only PCs enrolled in Extended Security Updates or running Windows 10 Enterprise LTSC 2021. They get KB5131096 (build 19045.7846 on 22H2, 19044.7846 on LTSC 2021). Other Windows 10 PCs get no security fixes.

Do I need to update Outlook separately?

Yes. The Outlook zero-day is fixed through Office updates, not Windows Update alone. In any Office app, go to File > Account > Update Options > Update Now.

Sources

• Microsoft Security Response Center, November 2026 Security Updates release notes: msrc.microsoft.com
• Microsoft Security Response Center, CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability: msrc.microsoft.com
• Microsoft Support, “November 10, 2026—KB5132061 (OS Builds 26300.9974, 26200.9974 and 26100.9974)”: support.microsoft.com
• Microsoft Support, KB5131087 (Windows 11 23H2): support.microsoft.com
• Microsoft Support, KB5131096 (Windows 10 ESU and LTSC 2021): support.microsoft.com
• Microsoft Learn, Windows 11 release information (updated November 10, 2026): learn.microsoft.com
• Microsoft Learn, Windows 10 release information: learn.microsoft.com
• Microsoft Learn, Windows 11 26H2, 25H2 and Windows 10 22H2 known issues: 26H2, 25H2, Windows 10
• Microsoft Learn, Microsoft 365 Apps security updates: learn.microsoft.com
• Microsoft Learn, Microsoft Edge security release notes: learn.microsoft.com
• CISA, Known Exploited Vulnerabilities Catalog (CVE-2026-124194 and CVE-2026-125350 added November 10, 2026): cisa.gov
• Google, Chrome Releases, Stable Channel Update for Desktop, November 9, 2026: chromereleases.googleblog.com
• BleepingComputer, “Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day,” November 10, 2026: bleepingcomputer.com
• BleepingComputer, “Windows 11 KB5132061 & KB5131087 cumulative updates released”: bleepingcomputer.com
• Zero Day Initiative, “The November 2026 Security Update Review,” November 10, 2026: zerodayinitiative.com
• Krebs on Security, “Microsoft Fixes Nearly 1,100 Security Vulnerabilities,” November 10, 2026: krebsonsecurity.com
• SecurityWeek, “Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft”: securityweek.com
• CSO Online, “November 2026 Patch Tuesday: 63 Critical Microsoft fixes, plus an Outlook zero day”: csoonline.com
• Rapid7, “Patch Tuesday – November 2026”: rapid7.com