How to Patch CVE-2026-124194 in Outlook and Update Windows 11

Here's what happened, what the numbers mean, and what to do on a Windows 11 PC.

The headline numbers, and why sources disagree​

Microsoft released the November security updates on November 10, 2026 (US time). Its Security Response Center notice tells customers using affected products to install them as soon as possible. The notice also points out that most Microsoft products install security updates automatically by default, with some exceptions.

The size of the release depends on who's counting:

• The Express says the update fixes 1,094 issues, with 63 rated Critical and one zero-day.
• Tenable counts 1,093 CVEs, with 63 rated critical, 1,029 rated important, and one rated moderate. PDQ's recap gives the same 1,093 breakdown.
• Splashtop, CyberInsider and NTCompatible use 1,094.

A one-CVE gap isn't a scandal. Splashtop's write-up hints at why the totals vary: Microsoft is also republishing 165 non-Microsoft CVEs, and trackers count those republished entries differently. The safe summary is "roughly 1,093–1,094 CVEs, 63 Critical, one exploited."

The Express also calls these "1,094 issues with this popular operating system." That's wrong. The count covers Microsoft's whole product range. CyberInsider reports the broader release addresses 1,094 CVEs across Microsoft's products, including 726 under Windows. Microsoft's own notice lists updates for Office, SharePoint, Exchange, SQL Server, Dynamics 365, Azure, .NET and Visual Studio as well as Windows. PDQ notes that Office accounts for 201 of the CVEs.

There's also a typo in the Express piece that needs correcting. It says these are updates that "should be ignored." They aren't. Install them.

Summary: about 1,093–1,094 CVEs across all Microsoft products, of which about 726 are in Windows. 63 are Critical and one is actively exploited.

The zero-day: CVE-2026-124194 in Outlook​

Microsoft's November notice names one vulnerability as exploited before the patch shipped: CVE-2026-124194, a Microsoft Outlook spoofing vulnerability.

Microsoft describes the attack this way, as quoted by the Express:

• An unauthenticated attacker sends a specially crafted message file.
• The attacker has to convince the target to open it in an affected version of Outlook.
• Outlook may then connect to an attacker-controlled network location without displaying its usual external-content warning.
• That connection can leak authentication information that could be used to impersonate the user. The attack needs network connectivity and the user's interaction.

Several security firms say what that authentication information is. Splashtop says the flaw can leak a user's NTLMv2 hash when they open a crafted message file. It adds that an attacker can use that hash to impersonate the user in follow-on attacks.

Why "spoofing" is a confusing label​

You might expect "spoofing" to mean a faked sender address. It doesn't here. One analysis puts it this way: Microsoft calls it spoofing because the stolen hash lets the attacker impersonate the victim, not because any email sender is forged. The underlying weakness is that the "product UI does not warn user of unsafe actions in Microsoft Office Outlook," which "allows an unauthorized attacker to perform spoofing over a network." The weakness maps to CWE-356.

Why a "Moderate" bug comes first​

The exploited flaw has the lowest severity label in the release. CVE-2026-124194 is rated only Moderate, with a CVSS score of 6.5. Three Outlook bugs in the same release are rated Critical, and none of them is under attack. Splashtop notes that for the third month in a row, the vulnerability attackers are actually using is rated below Critical, which is why exploit status should set the order of work.

Patching teams have learned this the hard way: a severity rating describes what a bug could do, while "Exploitation Detected" tells you attackers are already using it. A stolen NTLM hash is especially damaging in a corporate network. Jack Bicer, Director of Vulnerability Research at Action1, told the Express that if the victim is an administrator or a finance user, "the damage grows fast."

The US government is also treating it as urgent. On the same day, CISA added it to its Known Exploited Vulnerabilities catalog and gave federal agencies until November 24 to patch.

Summary: opening one crafted file in Outlook can leak your NTLMv2 hash with no warning. The rating is Moderate, but it's under active attack and listed by CISA.

The fix most people will miss: Outlook updates through Office​

The Express gives only the Windows Update steps. Those steps patch Windows, not Outlook. Microsoft has released fixes for Microsoft 365 Apps and Office LTSC 2021 and 2024. TheTechHacker puts it plainly: the fix doesn't come through Windows Update at all, it comes through Office's own updater, which a lot of people never look at.

Splashtop's prioritization guide also lists the zero-day fix as coming through the Microsoft 365 Apps and Office LTSC updates, on every device running Outlook, and recommends installing it within 72 hours.

Note that a Windows 11 laptop without classic Outlook or Office installed isn't exposed to this particular zero-day. It still needs the Windows fixes, though.

Step 1: Update Office (this fixes the zero-day)​

1. Open Outlook, Word, or any other Office app.
2. Go to File > Account.
3. Choose Update Options > Update Now. TheTechHacker recommends updating Office first this way, because that's where the fix for CVE-2026-124194 is delivered.
4. Let the update finish, then close and reopen Outlook.

What success looks like: Office reports that you're up to date after the check. If Update Now is missing or greyed out, your organization probably manages Office updates centrally, so ask IT whether the November build has been deployed.

Step 2: Update Windows 11​

1. Click Start and open Settings.
2. Select Windows Update.
3. Click Check for updates, then Download and install if an update is waiting.
4. Restart when prompted.

These are the November cumulative updates Microsoft lists for each Windows 11 version:

Microsoft rates the Windows 11 family's highest severity this month as Critical, with remote code execution as the most serious impact. That's the worst case across all the Windows 11 fixes, not a description of the Outlook bug. Tenable highlights one of those Critical Windows fixes: CVE-2026-119952, an RCE vulnerability affecting Windows Schannel.

The Windows update isn't only about security, either. CyberInsider reports that it fixes USB audio, printer installation, and Remote Desktop problems while strengthening NTLM authentication and PowerShell script verification.

What success looks like: after the restart, Settings > Windows Update > Update history shows the KB number for your version as installed. To check your version, run winver.

Summary: update Office to fix the zero-day, then update Windows to fix everything else. One does not cover the other.

For admins: what to do first​

For managed environments, the security firms broadly agree on this order:

• Outlook first. NTCompatible's advice: treat that 6.5 Outlook spoofing bug with the same urgency as a Critical RCE. Make sure your Microsoft 365 Apps channel or Office LTSC deployment has picked up the November build.
• Identity systems next. Splashtop puts Active Directory Domain Services, LDAP, Schannel, and CredSSP on domain controllers and authentication servers in its 72-hour group. A stolen NTLM hash is most useful to an attacker when they can move from machine to machine.
• Internet-facing servers. Exchange Server and IIS come next in the same guidance, starting with internet-facing systems. PDQ also flags CVE-2026-120002, a SharePoint Server elevation-of-privilege flaw scored 9.9 that requires no user interaction.
• Reduce NTLM exposure. This is general industry practice rather than Microsoft guidance for this CVE: limiting outbound SMB/NTLM traffic to the internet at the perimeter has long been a defense against hash-leaking bugs like this one.

Microsoft's notice also says it updated 87 existing vulnerability records on November 10. Those changes were informational only and need no customer action, so they shouldn't be added to your patch queue. The next scheduled release is December 8, 2026 (US time).

Volume isn't the same as danger​

This is another very large month. Action1's Bicer told the Express it marks the third straight month of patch volumes that would have seemed extraordinary earlier in the year. He put October at 1,409 patches, the record. Other trackers count October differently: NTCompatible cites roughly 1,474. The exact number matters less than the trend.

Those totals can mislead in both directions. More than a thousand CVEs sounds alarming, but NTCompatible notes that only one flaw, the CVE-2026-124194 Outlook spoofing bug, was actually being exploited in the wild, and none were publicly disclosed before the patch. The Express warns "everyone with a Windows 11 laptop," but the danger this month comes from opening a file in Outlook, and owning a Windows 11 laptop doesn't put you at risk by itself.

So, should every Windows 11 user worry? No. Should every Windows 11 user who runs Outlook check Office updates today? Yes. Apart from that, the usual habits still apply: be wary of unexpected attachments, keep both updaters current, and restart when asked.