Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day

Microsoft's November 2026 Patch Tuesday delivers fixes for a record 1,235 vulnerabilities, among them a Microsoft Outlook spoofing zero-day already being exploited in real-world attacks. The security update tackles 66 Critical-rated issues, including 48 remote code execution bugs, 15 elevation-of-privilege flaws, and three Edge use-after-free bugs, with roughly 639 of the total affecting Windows components. The Outlook zero-day lets an attacker send a crafted message file that, once opened, makes Outlook silently reach out to an attacker's server without the usual external-content warning, leaking the victim's NTLMv2 hash that can later be cracked or relayed to hijack accounts. This release follows October's 1,411-flaw update, as Microsoft keeps leaning on AI-assisted discovery and patching, and also folds in 108 fixes issued earlier in the month for Entra Device Registration, Mariner, and Microsoft Edge. Organizations should prioritize deploying the Outlook fix given its active exploitation and the broad scope of Critical RCE issues across Windows.