Microsoft released November security updates on November 10, 2026, covering Windows, Office, Exchange Server, SharePoint Server, SQL Server, Azure, Defender and developer tools. MS-ISAC advisory 2026-132 urges organizations to test and apply applicable fixes promptly. Some vulnerabilities in the wider release can allow remote code execution; that does not describe every issue in the release.
Prioritize CVE-2026-124194, an Outlook spoofing vulnerability that Microsoft marks as exploited. An attacker can persuade a user to open a crafted file, causing Outlook to contact an attacker-controlled network location without its usual warning. This can expose an NTLMv2 authentication hash, information that can support impersonation. Microsoft says network connectivity and user interaction are required, and the Preview Pane is not an attack vector. This is not a zero-click attack.
Microsoft rates this particular flaw Moderate with a CVSS base score of 6.5, but confirmed exploitation makes it an important patching priority. Do not confuse that rating with the severity of other November vulnerabilities or assume that all of the month's flaws are being exploited.
Inventory affected products and update channels, consult the applicable product-specific release notes and known issues, then test and deploy the supported updates. Verify installation and complete required restarts. Office and server products may need updates separate from Windows; there is no single build number that fixes every affected product. Retain least-privilege access, endpoint protection and network segmentation, and remind users not to open unexpected message files or attachments.
Sources: Microsoft November 2026 release notes; Microsoft Outlook CVE-2026-124194 advisory.
Attribution: MS-ISAC TLP:CLEAR advisory 2026-132, issued November 10, 2026. Exploitation status checked against Microsoft on that date.