I’M UNDER A CYBER ATTACK

Alert

Logo de Microsoft

Alert 2026-151 Actively exploited Outlook flaw and 64 critical issues in the November Patch Tuesday

Affected product(s):

FamilyKey updates
Windows 11 and Windows 10KB5132061 (24H2, 25H2 and 26H2; builds 26100.9974 / 26200.9974 / 26300.9974), KB5132059 (26H1), KB5131087 (23H2), KB5131096 (21H2 and 22H2) and KB5131085 (1809)
Windows ServerKB5131080 (2025), KB5131090 (2022), KB5131085 (2019) and KB5131291 (2016)
Office and Microsoft 365 AppsMicrosoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024
Application serversExchange Server Subscription Edition (KB5133453); SQL Server 2017, 2019, 2022 and 2025; SharePoint Server Subscription Edition; Microsoft Defender (engine 1.1.26100.4)
Cloud servicesEntra Device Registration and Azure OpenAI (already mitigated, no customer action required); Azure Managed Grafana (does require customer action)

Updates were released on Nov 10, 2026 at 13:00 (PST). On Windows 11 24H2/25H2/26H2, KB5132043 is the hotpatch alternative, not a second patch on top of KB5132061; on Server 2025, KB5131077 is the alternative to KB5131080.

Description

Microsoft has released the November 2026 security updates, which include a vulnerability already exploited in Outlook and 64 flaws that the vendor classifies as critical (48 remote code execution and 16 elevation of privileges). The official document brings together 1,342 records: 1,094 Microsoft CVEs from this cycle, the Entra Device Registration flaw disclosed ahead of schedule on Nov 5, 2026, 165 republished Chrome CVEs and 82 for Azure Linux and other third-party components.

The only Microsoft vulnerability in this batch with confirmed exploitation is CVE-2026-124194, an Outlook spoofing flaw with a CVSS of 6.5, medium (the vendor labels it Moderate, not Critical). According to the vendor, an attacker without credentials sends a crafted message file and convinces the user to open it; Outlook connects to the attacker’s server without showing the usual external content warning and delivers the NTLMv2 hash, which can be used to authenticate as the victim or in a relay attack. User interaction is required (opening the file) and network connectivity is required. The preview pane is not a vector for this CVE. The affected products are Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024; Office 2019 and the Mac editions are not listed in this particular advisory. The vendor did not consider it publicly disclosed before the patch and did not publish a workaround. On Nov 10, 2026 at 16:03 (PST) the vulnerability entered the Known Exploited Vulnerabilities catalogs, with the federal deadline of Nov 24, 2026. No public proof of concept was found. No other Microsoft flaw in this cycle has detected exploitation or prior public disclosure.

Among the 64 criticals, CVE-2026-109469 in Entra Device Registration reaches CVSS 10.0, critical, and CVE-2026-119990 in Azure OpenAI reaches CVSS 9.8, critical; the vendor has already mitigated them in the service and the customer does not have to apply a patch. However, updates are required for, among others, LDAP (CVE-2026-119958, CVSS 9.8, critical), Windows Search (CVE-2026-116928, CVSS 9.8, critical: an attachment sent to Exchange can be indexed without the recipient opening it), Active Directory (CVE-2026-118146 and CVE-2026-118148), Exchange Server Subscription Edition (CVE-2026-118207, CVSS 8.8, high; only that edition, no impact to Exchange 2019 or 2016 is stated), Schannel (CVE-2026-119952) and NAT (CVE-2026-113862). The vendor flags the Active Directory, Exchange, Schannel and NAT ones as most likely to be exploited. In Office, eight criticals other than 124194 have the preview pane as a vector (CVE-2026-110043, 110068, 111309, 110067, 111285, 124185, 111289 and 120003); they are not exploited.

Several CVSS 9.8 flaws in DNS (CVE-2026-88218), DHCP Server (CVE-2026-88243), Kerberos (CVE-2026-85844) and SQL Server (CVE-2026-116945) are classified by Microsoft as Important, not Critical. They should still be prioritized, especially Kerberos on domain controllers —an unauthenticated attacker can relay Kerberos traffic and reach SYSTEM— and SQL Server, where an integration package can execute code in the context of the service without SQL credentials. None of the 64 Microsoft criticals appears, as of Nov 10, 2026, in the Known Exploited Vulnerabilities catalogs. Known exploitation of those criticals was also not identified, nor a public proof of concept for the Outlook one.

In a separate note, unrelated to Microsoft: CVE-2026-20320 in Cisco BroadWorks (CVSS 7.5, high) is an XXE flaw in the Open Client Interface XML parser that allows an unauthenticated remote attacker to read configuration files. It affects Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform, and is fixed starting from RI.2026.07; the vendor did not publish workarounds. It also entered the Known Exploited Vulnerabilities catalogs on Nov 10, 2026, with the same federal deadline of Nov 24, 2026. The manufacturer’s advisory, in its text of Aug 19, 2026, does not confirm malicious use; no exploitation confirmation that the advisory did not update is attributed here.

Mitigation

It is recommended to immediately install the November updates for Windows, Office and Microsoft 365 Apps, Exchange Server Subscription Edition, SQL Server, SharePoint, the Defender engine and Microsoft Edge. A practical priority is: 1) Outlook and the rest of Office (CVE-2026-124194 and the criticals whose vector is the preview pane); 2) domain controllers (LDAP, Kerberos, Active Directory); 3) Exchange servers (KB5133453 and the Windows patch that closes Windows Search); 4) Schannel, NAT, DNS, DHCP and IIS; 5) SQL Server, without exposing it to the Internet.

On Windows 11 24H2, 25H2 and 26H2 use KB5132061 or, if the device is on hotpatch, KB5132043, not both as if they were separate cumulative updates. On Server 2025, KB5131080 or the hotpatch KB5131077. Verify the expected build. For Entra Device Registration and Azure OpenAI there is no customer patch; the vendor indicates it has already mitigated them. Azure Managed Grafana does appear with customer action: review the current advisory and the Azure portal.

The vendor did not publish a workaround for CVE-2026-124194 nor for the 64 criticals. While patching, as general —unofficial— measures you can block outbound SMB/NTLM traffic to the Internet (TCP 445 and UDP 137 to 139), restrict NTLM where possible, not expose to the Internet the LDAP, DNS, DHCP, Kerberos, SQL Server, Message Queuing ports nor Exchange administration, and monitor for anomalous NTLM authentications or Kerberos relays. The patch closes the flaw, but it does not undo a previous compromise. If misuse of 124194 is suspected, rotate the credentials of accounts that may have leaked the hash.

The vendor did not publish indicators of compromise, hashes, IP addresses or signatures for 124194 nor for the criticals.

Microsoft critical vulnerabilities (64)

The following tables list the 64 vulnerabilities that Microsoft classifies as Critical in this cycle (48 RCE and 16 EoP). The scores are the vendor’s CVSS 3.1, with the severity in words. None of these 64 appears with detected exploitation. Four Chrome/Edge CVEs are also listed as Critical in the same document, but they are republished and do not form part of these 64; they are fixed by updating Microsoft Edge.

Cloud services

CVEComponentTypeCVSS
CVE-2026-109469Entra Device RegistrationEoP10.0, critical
CVE-2026-119990Azure OpenAIEoP9.8, critical
CVE-2026-114160Azure Managed GrafanaEoP9.8, critical

CVE-2026-109469 and CVE-2026-119990 are already mitigated in the service, with no customer action required. CVE-2026-114160 does require customer action. Its CVSS 9.8 score appears in the Security Update Guide; this cycle’s CVRF document does not include it.

Windows: networking, directory and services

CVE-2026-118146, CVE-2026-118148, CVE-2026-118207, CVE-2026-113862 and CVE-2026-119952 are flagged by the vendor as most likely to be exploited. CVE-2026-116928 can reach Exchange servers by indexing an attachment, without the recipient opening it. CVE-2026-118207 affects only Exchange Server Subscription Edition. CVE-2026-125136, CVE-2026-113752, CVE-2026-113859, CVE-2026-118145 and CVE-2026-125134 are exploitable from an adjacent network.

CVEComponentTypeCVSS
CVE-2026-112967Xbox Live Networking ServiceRCE9.8, critical
CVE-2026-116928Windows SearchRCE9.8, critical
CVE-2026-119958LDAPRCE9.8, critical
CVE-2026-118146Active Directory Domain ServicesRCE8.8, high
CVE-2026-118148Active Directory Domain ServicesEoP7.5, high
CVE-2026-118207Exchange Server Subscription EditionRCE8.8, high
CVE-2026-125136Network Connected Devices Auto-SetupRCE8.8, high
CVE-2026-109459Message Queuing Queue ManagerRCE8.1, high
CVE-2026-116710Message QueuingRCE8.1, high
CVE-2026-119963Message QueuingRCE8.1, high
CVE-2026-119964Message QueuingRCE8.1, high
CVE-2026-119967Message Queuing Queue ManagerRCE8.1, high
CVE-2026-113862NATRCE8.1, high
CVE-2026-118737RPC RuntimeRCE8.1, high
CVE-2026-119951Deployment ServicesRCE8.1, high
CVE-2026-119952SchannelRCE8.1, high
CVE-2026-119961Internet Information ServicesRCE8.1, high
CVE-2026-119962CredSSPRCE8.1, high
CVE-2026-113752Print SpoolerRCE7.5, high
CVE-2026-113825SMB Server (srvnet.sys)RCE7.5, high
CVE-2026-113859TCP/IPRCE7.5, high
CVE-2026-118145Function Discovery SSDP ProviderRCE7.5, high
CVE-2026-125134Function Discovery Resource PublicationRCE7.5, high

Office, codecs and Defender

In CVE-2026-110043, 110068, 111309, 110067, 111285, 124185, 111289 and 120003 the vendor indicates that the preview pane is a vector; that vector does not apply to CVE-2026-124194. Several Word, Excel and Office ones also list Mac editions, according to each advisory.

CVEComponentTypeCVSS
CVE-2026-110043OutlookRCE8.8, high
CVE-2026-110068OutlookRCE8.8, high
CVE-2026-111309OutlookRCE8.8, high
CVE-2026-110047WordRCE8.8, high
CVE-2026-110067WordRCE8.8, high
CVE-2026-111285WordRCE8.8, high
CVE-2026-124185WordRCE7.5, high
CVE-2026-111289OfficeRCE8.8, high
CVE-2026-120003OfficeRCE8.8, high
CVE-2026-118292ExcelRCE8.8, high
CVE-2026-118296ExcelRCE8.8, high
CVE-2026-118297ExcelRCE8.8, high
CVE-2026-118701ExcelRCE8.8, high
CVE-2026-118702ExcelRCE8.8, high
CVE-2026-118711ExcelRCE8.8, high
CVE-2026-118713ExcelRCE8.8, high
CVE-2026-118730ExcelRCE8.8, high
CVE-2026-120786ExcelRCE8.8, high
CVE-2026-120788ExcelRCE8.8, high
CVE-2026-120789ExcelRCE8.8, high
CVE-2026-124170ExcelRCE7.5, high
CVE-2026-119969Graphic FontsRCE8.8, high
CVE-2026-120005PowerPointRCE8.8, high
CVE-2026-114169Raw Image ExtensionRCE8.8, high
CVE-2026-113749Windows Codecs LibraryRCE7.5, high
CVE-2026-122194Microsoft Malware Protection EngineRCE8.8, high

Windows: virtualization, graphics and local components

CVEComponentTypeCVSS
CVE-2026-113753Hyper-VEoP8.2, high
CVE-2026-113856Hyper-VEoP7.8, high
CVE-2026-113865Hyper-VEoP7.8, high
CVE-2026-113861Hyper-VEoP7.5, high
CVE-2026-119947Hyper-VEoP7.5, high
CVE-2026-119960Hyper-VEoP7.5, high
CVE-2026-113860Hyper-VEoP7.0, high
CVE-2026-113864Hyper-VEoP6.4, medium
CVE-2026-119382TPMEoP7.8, high
CVE-2026-119957Remote Desktop ServicesEoP7.8, high
CVE-2026-125137Graphics KernelEoP7.8, high
CVE-2026-119966Graphics KernelEoP7.5, high

Important of CVSS 9.8 (not Critical)

Microsoft labels the following four CVSS 9.8, critical, flaws with no authentication or interaction as Important, not Critical. They should still be prioritized, especially on domain controllers and on SQL Server, which should not be exposed to the Internet. There are other Important ones with CVSS 9.0 or higher (for example Azure DevOps, SharePoint, iSCSI, DirectMusic or Color Management) that are not detailed here.

CVEComponentTypeCVSS
CVE-2026-88218DNSRCE9.8, critical
CVE-2026-88243DHCP ServerRCE9.8, critical
CVE-2026-85844KerberosEoP9.8, critical
CVE-2026-116945SQL ServerRCE9.8, critical

Solution

The solution consists of applying the November 2026 security updates in Windows, Microsoft 365 Apps and Office LTSC, Exchange Server Subscription Edition, SQL Server and the rest of the affected products, with priority for Outlook, domain controllers, Exchange and the exposed network services. For Entra Device Registration and Azure OpenAI there is no customer patch because the vendor has already mitigated those flaws in the service. Office builds are found in the Office security notes; for 124194, among others, Office LTSC 2021 (16.0.14334.21048) and Office LTSC 2024 (16.0.17932.21140), plus the Microsoft 365 Apps channels (Current Channel 2610, 20527.20196, among others). In SQL Server, choose the applicable CU+GDR or RTM+GDR branch (for example KB5129299 or KB5129300) and do not mix packages blindly.

For BroadWorks, update to RI.2026.07 or later.

For information on how to update, visit the following link:

https://msrc.microsoft.com/update-guide/releaseNote/2026-Nov

Additional information: