Patch Tuesday, November 2026: 1,235 vulnerabilities fixed

On November 10, 2026, Microsoft released its monthly batch of security updates. It contains 1,235 fixes — the second month in a row with a four-digit count; October had 1,411. One vulnerability was already being exploited in attacks by the time the patch shipped, and it concerns email — something almost everyone uses.

The main threat: Outlook hands over your password hash

The worst item this month is CVE-2026-124194, an Outlook vulnerability that attackers were exploiting before the update existed.

Here is how it works. An attacker sends a specially crafted message file — as an email attachment, for example — and convinces you to open it. When you do, Outlook connects to a network location the attacker controls and skips the usual warning about external content. As Windows makes that connection, it automatically tries to authenticate and sends the NTLMv2 hash — a value derived from your password.

That hash can then be cracked offline, at the attacker’s leisure and with no risk of being noticed, and used to impersonate you: on a corporate network, that is a direct path to other people’s mail and files. Exploitation requires network connectivity and one action from you — opening the file.

Installing the update is enough to close the hole. It is also worth not opening .msg and .eml attachments from senders you don’t know: in this scheme, you are the one opening the door. If you did open such a message, change your password — the old hash becomes useless after that.

Sources: CVE-2026-124194 — Microsoft Security Update Guide (vulnerability description, requires network connectivity and user interaction); BleepingComputer report on the November Patch Tuesday (NTLM hash theft, exploitation before the patch).

What else changed in security

Beyond the patched flaws, the update brings two changes worth understanding. Windows now offers NTLM message signing by default for non-anonymous connections — protection against relay attacks, in which an attacker intercepts and relays authentication. On a home PC the difference is invisible, but if your network has an older NAS or printer, some setup may be needed after the update: if a network share stops opening, this is a likely reason.

The second change concerns Secure Boot certificates. Microsoft keeps replacing the ones that expire in 2026: devices that have not received the new certificates still boot and keep getting updates, but they are being rolled out gradually. That is one more reason not to put updates off for six months — a PC that has not been updated in a year may end up at the back of that queue.

Source: KB5132061 — Microsoft Support, the sections on NTLM signing and Secure Boot certificates.

Also fixed

The update fixes three things that have been annoying people. After the September updates, USB Audio 1.0 devices could fail to start and show Code 10 in Device Manager — that is fixed on both Windows 11 and Windows 10. Adding a printer published in Active Directory failed with error 87, “The parameter is incorrect”; the bug appeared in the October update and is now gone. And on Windows 10, Microsoft tightened encoding checks for PowerShell script signing: scripts with invalid UTF-8 may no longer pass signature validation, so they should be re-saved in UTF-8 with a BOM and signed again.

Source: KB5132061 — Microsoft Support; KB5131096 for Windows 10 — Microsoft Support.

Which update is yours

Packages differ by version — here are the numbers and builds, so you can tell what you have:

Windows 11 26H2, 25H2, 24H2 — KB5132061, builds 26300.9974, 26200.9974 and 26100.9974.
Windows 11 26H1 — KB5132059, build 28000.3501.
Windows 11 23H2 — KB5131087, build 22631.7711. For Enterprise and Education editions this is the last security update: the version has reached end of support.
Windows 10 22H2 — KB5131096, build 19045.7846. It arrives through the ESU program: without ESU enrollment or LTSC, you won’t get it.

Sources: KB5132061, KB5132059, KB5131087, KB5131096 — Microsoft Support.

How many flaws were fixed

Total fixes: 1,235.
Critical: 66, including 48 remote code execution, 15 elevation of privilege, and three in Microsoft Edge.
By category: 536 elevation of privilege, 296 remote code execution, 157 information disclosure, 46 denial of service, 27 security feature bypass, 22 spoofing, 142 in Edge.
About 639 fixes affect Windows products and components.
Exploited zero-days: one — the Outlook flaw described above.

The next Patch Tuesday is December 8, 2026.

Source: BleepingComputer report on the November Patch Tuesday; monthly MSRC bulletin (confirms the single vulnerability exploited before the patch).

If the update won’t install

This month has its own story: on some devices the November update failed to install with errors 0x80070306, 0x800f0989 and 0x800f0993. Those affected had installed the October preview update KB5127936. Microsoft confirmed the problem on November 12 and said it would repair affected devices automatically within 24–48 hours, with no action required from users.

If the error still appears, check for updates again, restart, and check once more. If that does not help, run DISM /Online /Cleanup-Image /RestoreHealth and sfc /scannow, then retry the installation.

Source: BleepingComputer, November 12, 2026 (confirmation of the issue and the automatic repair timeline).

The short version

Open Settings → Windows Update → Check for updates.
Let it install and restart: some fixes only apply after a reboot.
Check that the build number changed — if it didn’t, the update didn’t install.
Don’t open .msg and .eml attachments from senders you don’t know.
If you opened a suspicious message, change your password.

The update takes a few minutes and one restart. The Outlook vulnerability is already being exploited in the meantime, so it is better not to put it off.