Microsoft's November 2026 Patch Tuesday (November 10) is one of the biggest ever: 1,235 security fixes, 66 rated Critical, and one Outlook zero-day that attackers were already using to steal passwords. It is also the final security update for Windows 11 version 23H2 Enterprise and Education.
Here's what was fixed, which KB to install for your Windows version, and what home users and IT admins should patch first.
Quick answer: Install the November update now: KB5132061 for Windows 11 24H2/25H2, KB5131087 for 23H2 (its last update) and KB5131096 for Windows 10 ESU. Also update Microsoft Office / Microsoft 365 Apps, because the exploited zero-day, CVE-2026-124194, is fixed in Office, not in the Windows update. Admins: patch Outlook, Exchange Server, Active Directory domain controllers and internet-facing servers first. CISA's deadline for the zero-day is November 24, 2026.
Last updated: November 13, 2026.
Table of contents
- November 2026 Patch Tuesday at a glance
- Which update to install (KB numbers)
- The Outlook zero-day
- Critical flaws to patch first
- Windows 11 23H2 reaches end of updates
- What's new and fixed in the Windows update
- Patch priority plan for IT admins
- How home users install it
- FAQ
November 2026 Patch Tuesday at a glance
| Release date | November 10, 2026 |
| Total fixes | 1,235 (including 142 Microsoft Edge/Chromium fixes) |
| Windows-related | About 639 |
| Critical | 66 (48 remote code execution, 15 elevation of privilege, 3 Edge) |
| Exploited zero-days | 1: CVE-2026-124194 (Outlook spoofing) |
| Biggest categories | Elevation of privilege (536), remote code execution (296), information disclosure (157) |
| Last update for | Windows 11 23H2 Enterprise and Education |
Why so many? Microsoft says it keeps using AI to find and patch vulnerabilities faster, which has made recent Patch Tuesdays much larger than they used to be. The count also includes Edge and other cloud and open-source components.
Which update to install (KB numbers)
| Windows version | KB | Build |
|---|---|---|
| Windows 11 25H2 | KB5132061 | 26200.9974 |
| Windows 11 24H2 (Enterprise/Education) | KB5132061 | 26100.9974 |
| Windows 11 26H1 | KB5132059 | 28000.3501 |
| Windows 11 23H2 (final) | KB5131087 | 22631.7711 |
| Windows 10 22H2 (ESU) | KB5131096 | 19045.7846 |
| Windows 10 21H2 / LTSC 2021 | KB5131096 | 19044.7846 |
To check your version, press Win + R, type winver and press Enter. If the update fails, see our guide: KB5132061 won't install? Fix 0x800f0993, 0x80070306 and 0x800f0989.
The Outlook zero-day
CVE-2026-124194 is an Outlook spoofing flaw that Microsoft marked as exploitation detected. An attacker sends a specially crafted message file. When the user interacts with it, Outlook connects to an attacker-controlled server without the usual external-content warning, which can leak the user's NTLM password hash.
- Rated: Moderate (CVSS 6.5), but it is being used in real attacks, so treat it as urgent.
- Fixed in: Microsoft 365 Apps and Office LTSC security updates, not in KB5132061.
- CISA deadline: added to the Known Exploited Vulnerabilities catalog; US federal agencies must patch by November 24, 2026.
Full details and patch steps: Outlook zero-day CVE-2026-124194: what it does and how to patch.
Critical flaws to patch first
| CVE | Product | Why it matters |
|---|---|---|
| CVE-2026-118207 | Exchange Server | Remote code execution on mail servers |
| CVE-2026-118146 / CVE-2026-118148 | Active Directory Domain Services | Remote code execution and elevation of privilege on domain controllers |
| CVE-2026-118737 | Remote Procedure Call Runtime | Unauthenticated network remote code execution |
| CVE-2026-119961 | Windows IIS | Unauthenticated remote code execution on web servers |
| CVE-2026-119962 | Windows CredSSP | Unauthenticated remote code execution (used by RDP) |
| CVE-2026-119963 / CVE-2026-119964 | Windows Message Queuing (MSMQ) | Unauthenticated remote code execution if MSMQ is enabled |
| CVE-2026-120003, CVE-2026-110068 | Microsoft Office / Outlook | Remote code execution through documents and email |
| CVE-2026-122194 | Microsoft Defender | Remote code execution |
| CVE-2026-119947 (+3 related) | Windows Hyper-V | Elevation of privilege from a guest VM |
Windows 11 23H2 reaches end of updates
KB5131087 is the last security update for Windows 11 23H2 Enterprise and Education (Home and Pro on 23H2 already stopped getting updates earlier). From December 2026, PCs that stay on 23H2 get no more security fixes.
- Move those PCs to Windows 11 24H2 or 25H2 through Windows Update, Intune feature update policies or your WSUS/ConfigMgr setup.
- Check for apps and drivers that block the upgrade first. A pilot group of 5–10% of devices helps.
What's new and fixed in the Windows update
KB5132061 includes the features from the October 28 preview update. Many roll out gradually:
- Customizable right-click menu in File Explorer (see how to customize it)
- Cloud rebuild, to reinstall Windows through Windows Update (see how cloud rebuild works)
- Refreshed AutoPlay dialog and updates to Narrator, Magnifier, Live Captions and Settings
Important fixes and changes:
- USB Audio Class 1.0 devices showing error code 10 after a recent update
- Error 87 when adding printers published in Active Directory
- RDP certificate mismatch failures after the October preview
- NTLM message signing is now offered by default for non-anonymous connections
- Signed PowerShell scripts get stricter encoding checks and may fail if they contain invalid UTF-8. Test your signed scripts.
Microsoft lists no known issues for KB5132061, KB5132059 or KB5131087 at the time of writing.
Patch priority plan for IT admins
- Office first. Make sure Microsoft 365 Apps are on the latest build (File > Office Account > Update Options > Update Now, or push it through your update channel).
- Servers next: Exchange, domain controllers, IIS, RDP gateways and anything with MSMQ enabled. Disable MSMQ where you don't use it.
- Endpoints: roll KB5132061 to a pilot ring, then to everyone within a week or two.
- Block outbound SMB/NTLM to the internet (TCP 445) at the firewall. It limits hash-theft attacks like the Outlook zero-day.
- Test signed PowerShell scripts and AD-published printers after patching, because of the encoding and printer changes.
- Start the 23H2 upgrade project if you haven't already.
How home users install it
- Open Settings > Windows Update and click Check for updates. Install everything offered and restart.
- Open any Office app (Word or Outlook) and go to File > Account > Update Options > Update Now.
- Update your browser too: Edge and Chrome both got security fixes this month.
FAQ
How many vulnerabilities did Microsoft fix in November 2026?
1,235 by BleepingComputer's count, including 142 Microsoft Edge fixes. 66 are rated Critical.
Is there a zero-day in November 2026 Patch Tuesday?
Yes, one: CVE-2026-124194, an Outlook spoofing flaw that was exploited to steal NTLM hashes. Update Office or Microsoft 365 Apps to fix it.
What is the KB number for Windows 11 November 2026?
KB5132061 for Windows 11 24H2 and 25H2, KB5131087 for 23H2 and KB5132059 for 26H1.
Is this the last update for Windows 11 23H2?
Yes. KB5131087 is the final security update for Windows 11 23H2 Enterprise and Education. Upgrade to 24H2 or 25H2.
Are there known issues?
Microsoft lists none for KB5132061 at the moment. Signed PowerShell scripts with invalid UTF-8 encoding may now fail validation.
Do Windows 10 PCs get this update?
Only PCs enrolled in Extended Security Updates (ESU) get KB5131096.
Related: Secure Boot certificate update 2026: how to check and fix it.
Sources: BleepingComputer (Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day), Qualys Patch Tuesday review, Windows Mode (November 2026 KB and build numbers) and Microsoft release notes. Checked November 13, 2026.
0 Comments