Microsoft's November 10, 2026 updates fix 1,093 vulnerabilities, 63 rated critical. One, the Outlook spoofing flaw CVE-2026-124194, is already exploited. Exchange admins also get a zero-click Windows Search bug and domain controllers a critical LDAP fix.
Install this month’s Office and Windows updates now, and start with Outlook. Microsoft’s November 10 release fixes 1,093 vulnerabilities, according to Krebs on Security, and one of them is already being used in attacks: CVE-2026-124194, a spoofing flaw in Microsoft Outlook. If you run Exchange Server or Active Directory, two other critical fixes belong at the top of your list this week.
What Microsoft fixed
Krebs counts 1,093 fixes, 63 of them rated critical. Nearly half of the critical bugs allow remote code execution, and 535 of all the flaws let an attacker raise their privileges on a machine. The Zero Day Initiative’s review puts the total at about 1,090 and says none of this month’s bugs were publicly known before the release.
The one exploited bug:
- CVE-2026-124194, Outlook spoofing. It affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office, per Krebs. ZDI rates it CVSS 6.5 and says opening a crafted message file can leak the user’s NTLMv2 password hash, which attackers can crack or relay to log in elsewhere. The Preview Pane is not an attack vector, according to ZDI. Microsoft has not said who is exploiting it.
The critical fixes ZDI flags for fast deployment:
- CVE-2026-116928, Windows Search, CVSS 9.8. An unauthenticated attacker can email a crafted attachment to an Exchange Server, which indexes it automatically. No click is needed.
- CVE-2026-119958, Windows LDAP, CVSS 9.8. An out-of-bounds write that can run code on a server, with domain controllers the main concern. “Test and deploy this one quickly,” ZDI writes.
- CVE-2026-119952, Windows Schannel, CVSS 8.1. Microsoft rates exploitation “more likely,” per ZDI.
ZDI counts 30 wormable bugs this month, down from 59 in October, across DNS, Message Queuing and Exchange. Exchange Server gets nine patches in total, including the critical remote code execution flaw CVE-2026-118207.
Why the count is so high
A year ago Microsoft averaged about 100 fixes a month, Krebs notes. October brought more than 1,400, November 1,093, and the 2026 total now tops 5,100. Microsoft credits AI tools for finding and fixing that volume. ZDI says these are the two biggest months in Microsoft’s history. Exploitation has not grown at the same pace: Ivanti’s Chris Goettl told Krebs that only 217 vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities list this year, out of about 95,000 CVEs assigned across all vendors.
What to do today
- On a Windows PC with Office or Microsoft 365: open Windows Update and install everything offered, then open Outlook or any Office app and update it (File > Office Account > Update Options > Update Now). Restart when asked.
- If you run Exchange Server: apply the November Exchange and Windows Server updates first. The Windows Search bug reaches a server through ordinary inbound mail.
- If you manage domain controllers: test and deploy the LDAP fix this week.
- On a Mac: Microsoft’s Windows fixes don’t apply, but Apple shipped its own out-of-cycle updates this week for at least nine flaws, Krebs reports, including the iMessage group chat bug in iOS 27.2.1.
Browsers need their own update. Chrome 157.0.8103.50 closes an exploited XML bug, and Krebs says Firefox 160 fixes almost 100 CVEs. Adobe also patched at least 110 vulnerabilities this month and says none are being exploited.
Small teams carry the Outlook risk
The exploited flaw is rated moderate, and that rating undersells it for a small company. A leaked NTLM hash is a working credential on a network that still accepts NTLM, and one person opening one crafted file is enough. Large IT departments push Office updates centrally. A five-person startup usually leaves updates to each laptop owner, which is the gap this bug fits. If you manage a team, ask everyone to confirm their Office build is current today, and keep a short list of who confirmed. The Exchange and LDAP bugs score higher, but they mostly affect companies that still run their own mail and directory servers. For a team on Microsoft 365 in the cloud, Microsoft patches the servers, and the job is the laptops.