Patch Tuesday November 2026: over 1,000 fixes and an Outlook zero-day found with Claude

Microsoft's Patch Tuesday for November 2026 landed on 10 November with more than 1,000 security fixes for the second month in a row, and one of them is already being used in attacks: an Outlook bug, CVE-2026-124194, that can leak your Windows sign-in hash when you open a booby-trapped message file. Microsoft says the bug was found with help from Anthropic's Claude. If you use Windows or Office, the short version is simple: install this month's updates now.

Our 27-second version:

Image: Jiaqian AirplaneFan, Microsoft Building 92 in Redmond (CC BY 3.0, via Wikimedia Commons)

How many flaws did Patch Tuesday November 2026 fix?

It depends on who is counting, but every count is above 1,000.

• BleepingComputer counted 1,235 flaws released on Patch Tuesday itself. It leaves out 108 more that Microsoft fixed earlier in the month (82 in Azure Linux "Mariner", 25 in Edge and one in Entra).
• The Record, citing Microsoft, reported 1,093 bugs disclosed on Tuesday.
• BleepingComputer rates 66 of them critical; The Record cites experts who counted 63.

BleepingComputer's breakdown shows where they sit: 536 elevation-of-privilege bugs, 296 remote code execution bugs, 157 information-disclosure bugs, 46 denial-of-service bugs, 27 security-feature bypasses, 22 spoofing bugs and 142 Edge (Chromium) fixes.

The trend is the story. Microsoft disclosed about 900 vulnerabilities in September, then more than 1,400 in October, according to The Record. Satnam Narang of Tenable told the publication that this release takes Microsoft past 5,160 vulnerabilities disclosed in 2026, far more than any earlier year. BleepingComputer links the jump to Microsoft's use of AI to find and patch bugs.

What is the Outlook zero-day, CVE-2026-124194?

A zero-day is a flaw attackers exploit before a fix exists. This month there is one, and it is in Outlook. Microsoft calls it a spoofing vulnerability and gives it a severity score of 6.5. That is not "critical", but it is the bug that criminals are using right now.

Chart: NextDiff, based on Microsoft's advisory as quoted by BleepingComputer and The Record

In Microsoft's words, an attacker "could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook." Opening the file can make Outlook connect to an attacker-controlled network location "without displaying the usual external-content warning."

How does the attack work?

BleepingComputer explains the mechanics. This is an NTLM credential leak:

1. The attacker sends a crafted message file. No account or login is needed.
2. The victim opens it in an unpatched copy of Outlook.
3. Outlook quietly connects to a network share the attacker controls.
4. Windows tries to sign in to that share automatically and hands over the user's NTLMv2 hash. The attacker can crack it offline or use it to impersonate the user.

Narang told The Record that a successful attack may let someone sign in as the victim. BleepingComputer says the bug has been exploited "to steal NTLM account hashes". The US Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities list and given federal agencies until the end of the month to patch.

Why does it matter that Claude found it?

Microsoft credits the discovery to Benoît Sevens "using Anthropic's Claude", The Record reports. It is the latest sign that AI models are now finding real, exploitable bugs, not just toy ones. Earlier this month a Claude-built exploit turned a Linux kernel flaw into remote root (our story). Anthropic's newest model, Claude Fable 5.2, is pitched at exactly this kind of long, careful code work.

The upside is more bugs fixed before criminals find them. The downside is the volume. Two months of 1,000-plus fixes means more testing for IT teams, and less time between a patch and an attack built from it.

Image: Wonderlane, cables and switches at Microsoft in Redmond (CC0, via Wikimedia Commons)

Which other bugs should admins look at?

The critical list includes a remote code execution bug in Windows Active Directory Domain Services (CVE-2026-118146), a matching elevation-of-privilege bug (CVE-2026-118148), a Graphic Fonts remote code execution bug (CVE-2026-119969) and an elevation-of-privilege bug in Azure OpenAI (CVE-2026-119990). Domain controllers deserve the first maintenance window.

Microsoft was not the only vendor with an exploited bug this week. CISA also added a Chrome use-after-free flaw (CVE-2026-125350) to its list on 10 November, so update your browser too.

How do I install the November 2026 update?

• Windows 11: the cumulative updates are KB5132061 and KB5131087. Go to Start → Settings → Windows Update → Check for updates, then restart. BleepingComputer says the updates are mandatory because they carry the security fixes, and Microsoft knows of no new issues with them.
• Windows 10: only PCs on Extended Security Updates (or Enterprise LTSC) get KB5131096, which moves them to build 19045.7846. It also makes PowerShell stricter about invalid UTF-8 in signed scripts, so a few old scripts may fail signature checks.
• Outlook and Office: update through Windows Update (with "Receive updates for other Microsoft products" turned on) or from any Office app via File → Account → Update Options → Update Now.

Until every PC is patched, don't open unexpected message files, even from people you know. Companies can also block outbound SMB (port 445) at the firewall, a common defence against this kind of hash leak.

What's next?

NTLM leaks are well understood, so public proof-of-concept code for the Outlook bug would not be a surprise. The next Patch Tuesday falls on 8 December. If the 1,000-a-month pace holds, 2026 will end with far more Microsoft fixes than any year before. Microsoft's Paint fix earlier this month also skipped Windows Update entirely (check your version), so "fully patched" now means checking more than one place.