---
title: Microsoft patches 1,093 security flaws in November, including actively exploited Outlook zero-day
url: https://www.dataloco.com/en/microsoft-patches-1093-security-flaws-in-november-including-actively-exploited-outlook-zero-day
published: 2026-11-13T20:21:27+00:00
language: en
section: Security
source: https://www.it-connect.fr/patch-tuesday-novembre-2026-recapitulatif/
organizations: Microsoft
publisher: Dataloco
---

# Microsoft patches 1,093 security flaws in November, including actively exploited Outlook zero-day

Microsoft released security updates for 1,093 vulnerabilities on November 10, 2026, marking the second-largest monthly patch release in the company's history. The November Patch Tuesday follows October's record of 1,407 fixed flaws, a decrease of 314 vulnerabilities but still substantially higher than September's 973 patches.

Windows accounted for 733 of the vulnerabilities, while Microsoft Office received 174 patches. SQL Server, SharePoint Server, and Exchange Server were also addressed with 52, 27, and 9 fixes respectively. Among all patched flaws, 63 were classified as critical. Nearly half of the vulnerabilities, totaling 535, involved privilege escalation attacks that allow attackers already present on a system to gain elevated rights. An additional 296 vulnerabilities could lead to remote code execution.

One zero-day vulnerability, tracked as CVE-2026-124194, was already being exploited in active attacks at the time of the patch release. This flaw affects Outlook and is classified as a spoofing vulnerability with a CVSS score of 6.5 out of 10, assigned a moderate severity rating by Microsoft. The attack scenario involves an attacker sending a specially crafted malicious Office file to a target. When the user opens the file, Outlook connects to a network location controlled by the attacker without displaying the standard warning about external content. This connection can leak the user's NTLMv2 hash, which attackers can attempt to crack offline to recover the password or use in NTLM relay attacks. The vulnerability requires network connectivity and user interaction to exploit. The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, with patches distributed through Office updates.

Windows 11 version 23H2 received its final updates as part of this month's release. For Windows 11 version 24H2, only Enterprise and Education editions received updates, as Home and Professional editions received their last patches in October. Windows 10 updates were limited to LTSC editions and machines enrolled in the Extended Security Updates program.

## This story in other languages

- [Português (Brasil)](https://www.dataloco.com/pt-br/microsoft-corrige-1-093-falhas-de-seguranca-em-novembro-incluindo-vulnerabilidade-zero-day-no-outlook)