Microsoft’s November security update, released Tuesday, Nov. 10, fixes more than 1,000 flaws across Windows, Office and other products, including a bug in Outlook that attackers are already using. The company rates that Outlook flaw only “moderate,” but security researchers say it deserves quick attention because a single opened file can hand over the information criminals need to pose as you.
The patch, tracked as CVE-2026-124194, is now available for Windows 11, Windows 10 users with extended security updates, and supported versions of Microsoft Office. Most home users will get it automatically, but it only protects you once it is installed and your computer has restarted.
What the Outlook flaw does
According to Microsoft’s advisory as summarized by The Hacker News and BleepingComputer, an attacker sends a specially crafted message file. If the target opens it in an affected version of Outlook, the program quietly connects to a network location the attacker controls, skipping the usual warning about outside content. That connection can leak a scrambled version of the user’s Windows login credentials, known as an NTLMv2 hash.
Criminals can try to crack that hash offline or reuse it to impersonate the victim on other systems. Infosecurity Magazine reported the bug affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. The attack does require the victim to open the file, which is why experts keep returning to the same advice: be careful with unexpected attachments.
“A stolen hash can open doors far beyond the inbox.” — Jack Bicer, Action1, to Infosecurity Magazine
The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its list of known exploited vulnerabilities, giving federal agencies until Nov. 24 to patch, The Hacker News reported. Microsoft has not said who is behind the attacks or how widespread they are.
Found with help from AI
Microsoft’s advisory credits a researcher known as “nono” and Benoît Sevens, whose credit notes he was using Anthropic’s Claude AI model, according to Notebookcheck and The Hacker News. Neither outlet said whether the flaw was found before or after criminals began using it. The credit is a small but notable sign of how AI tools are now part of everyday security research. Anthropic, the company behind Claude, is also in the news this week as it sets a price range for its planned stock market debut.
Why the patch list keeps getting longer
Security outlets counted the total differently depending on what they included: BleepingComputer and Infosecurity Magazine put it at 1,235, Günter Born’s Windows blog at 1,093, and The Hacker News at 1,259 including fixes issued by outside partners. By any count it is one of the largest monthly releases Microsoft has shipped. Infosecurity Magazine said this is the fourth record-setting month of 2026, after July, September and October, and The Hacker News reported it is the second month in a row above 1,000.
CyberScoop reported earlier this year that Microsoft is leaning more on AI to find weaknesses faster, and that researchers so far see no matching jump in real-world attacks. Tenable’s Satnam Narang told CyberScoop that AI is creating “larger haystacks” without finding many more needles. In practice, that means most of these bugs are being fixed before anyone uses them, while a small number, like this Outlook flaw, need urgent action.
Among the critical fixes this month are remote code execution bugs in Windows Search, the Windows Schannel security component and Exchange Server, according to The Hacker News and Born’s blog. Those mostly matter to businesses and IT departments, but they are bundled into the same updates home users receive.
How to protect your computer
- Run Windows Update: On Windows 11, go to Settings, then Windows Update, and install the November update (KB5132061), then restart.
- Update Office: Office usually updates itself. To check, open Outlook and go to File, Office Account, Update Options, Update Now, as Notebookcheck describes.
- Be wary of attachments: Until you are updated, avoid opening message files or Office documents from unexpected emails, even ones that appear to come from people you know.
- Back up first: Save important files before installing major system updates.
Why it matters for families
Many households share one computer for school, work email and banking. A stolen login hash from a work or family account can be a starting point for bigger trouble, from account takeovers to convincing scams. Criminals are already using AI to impersonate executives and lawyers, so keeping the basic protections current matters more than ever. A few minutes to install updates, plus a family rule about not opening surprise attachments, goes a long way.
What to watch next
Watch for Microsoft or security firms to share more about who exploited the Outlook flaw and how widely, and for any reports of problems caused by this month’s updates. With AI-assisted bug hunting speeding up, December’s release could be large again. Upstormed News will follow this story.
Read more: Apple Will Check Public iCloud Links for Harmful Content in iOS 27.3
Do you install Windows and Office updates right away, or wait a few days?
Sources: BleepingComputer, “Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day” (November 10, 2026); The Hacker News, “Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes” (November 11, 2026); Infosecurity Magazine, “Microsoft Fixes 1235 Flaws in Another Record Patch Tuesday” (November 11, 2026); Notebookcheck, “Exploited Outlook zero-day was found by a researcher using Claude” (November 11, 2026); Borns IT- und Windows-Blog, “Microsoft Security Update Summary (10. November 2026)” (November 10, 2026); CyberScoop, “Microsoft discloses two actively exploited zero-days among 974 vulnerabilities” (2026)
Leave a Reply