KB5132061 and CVE-2026-124194: November 2026 Patch Tuesday, Outlook zero-day leaks NTLM hashes

Microsoft's November 2026 Patch Tuesday, released on 10 November, fixes more than a thousand vulnerabilities, including one Outlook flaw, CVE-2026-124194, that Microsoft says attackers were already exploiting to steal Windows sign-in hashes. The headline count depends on who is counting: BleepingComputer reports 1,235 flaws, while Tenable counts 1,093 CVEs. Either way it is another record-scale month, and for most organisations the practical work is the same: install the November cumulative update, check Outlook and Office, and test two behaviour changes (NTLM signing and PowerShell signature checks) before they surprise you.

Key points

• Microsoft's one exploited zero-day this month is CVE-2026-124194, an Outlook spoofing flaw that leaks NTLMv2 hashes; Tenable lists it as Moderate with a CVSSv3 score of 6.5.
• BleepingComputer counts 1,235 flaws fixed (66 Critical); Tenable counts 1,093 CVEs across 287 products (63 Critical). The two counts do not match and neither source explains the gap.
• Windows 11 24H2, 25H2 and 26H2 get KB5132061 (builds 26100.9974, 26200.9974 and 26300.9974); Windows 11 23H2 gets KB5131087; Windows 10 ESU gets KB5131096 (build 19045.7846).
• Clients now offer NTLM message signing by default for non-anonymous connections, and PowerShell signature validation is stricter about invalid UTF-8.
• Microsoft says it is not aware of any known issues with KB5132061, though BleepingComputer's source for install errors is covered below.

What to do

1. Install the update. Windows 11 24H2, 25H2 and 26H2: KB5132061. Windows 11 23H2 (Enterprise and Education): KB5131087, which is the last update for that edition because 23H2 reached end of updates on 10 November 2026, according to a Windows Forum summary of Microsoft's release notes. Windows 10 Enterprise LTSC and ESU-enrolled devices: KB5131096. Use Settings, Windows Update, Check for updates, or the Microsoft Update Catalog for manual installs.
2. Prioritise Outlook and Office. The exploited bug is in Outlook, and Tenable lists Word (65 CVEs), Excel (64) and Outlook (20) among the most-patched products. Make sure Microsoft 365 Apps and standalone Office installs update on the same cycle as Windows.
3. Check whether you are affected by the NTLM leak. Microsoft's description, as reported by BleepingComputer, says opening a crafted message file can make Outlook connect to an attacker-controlled network location without the usual external-content warning. If outbound SMB or WebDAV traffic to the internet is allowed from user machines, that is the path a hash would leave by; blocking it at the firewall is a sensible extra layer, though Microsoft's advisory is the place to confirm what it recommends.
4. Test two behaviour changes before wide rollout (details below): NTLM signing audit events, and re-signing PowerShell scripts that contain invalid UTF-8.
5. Verify the install. Neowin, as relayed by Windows Forum, reported download or install failures for KB5132061, mostly error 0x800f0993 and some 0x800f0989. How widespread that is has not been established, so check Windows Update's status or the OS build number rather than assuming success.

What happened

Microsoft shipped its monthly security updates on 10 November 2026. BleepingComputer's tally is 1,235 flaws, which it calls a record, and its breakdown puts 66 of them at Critical: 48 remote code execution, 15 elevation of privilege and 3 use-after-free bugs in Microsoft Edge. Tenable's tally, the eleventh Patch Tuesday of 2026 in its numbering, is 1,093 CVEs: 63 Critical, 1,029 Important and 1 Moderate, spread over 287 products and components.

The difference is not a rounding issue. BleepingComputer says its total leaves out 108 flaws that Microsoft fixed earlier in November (one in Entra Device Registration, 82 in Mariner and 25 in Microsoft Edge), and its category table adds up to 1,226, nine short of its headline, with no explanation. Tenable does not say how it counted. We have not been able to open Microsoft's own Security Update Guide, which loads its data with JavaScript, so we cannot say which figure matches Microsoft's list. When you quote a number for this month, say which source it comes from.

The one flaw Microsoft marks as exploited is CVE-2026-124194, a Microsoft Outlook spoofing vulnerability. BleepingComputer describes an unauthenticated attacker sending a specially crafted message file and persuading a user to open it. Doing so can make Outlook connect to a network location the attacker controls, without the external-content warning users normally see, which exposes the user's authentication information. Captured NTLMv2 hashes can be cracked offline or relayed to impersonate the user. Tenable rates it Moderate with a CVSSv3 score of 6.5, and notes that the advisory credits a security researcher who used Claude, an LLM from Anthropic; the page does not name a model version.

Other bugs the sources single out, all authenticated unless noted:

• CVE-2026-118146, Active Directory Domain Services remote code execution, Critical, CVSSv3 8.8, "Exploitation More Likely" (Tenable). A matching Active Directory elevation of privilege flaw, CVE-2026-118148, is also Critical per BleepingComputer.
• CVE-2026-118207, Exchange Server remote code execution, Critical, CVSSv3 8.8, More Likely.
• CVE-2026-119952, Windows Schannel remote code execution, Critical, CVSSv3 8.1, unauthenticated over the network, More Likely.
• CVE-2026-120002, SharePoint Server elevation of privilege, CVSSv3 9.9, rated Important with "Less Likely" exploitation.
• CVE-2026-113862, Windows NAT remote code execution, Critical, CVSSv3 8.1, More Likely.
• CVE-2026-121662 and CVE-2026-121663, Visual Studio Code remote code execution (8.6) and security feature bypass (8.8), both More Likely.
• CVE-2026-122194, Microsoft Defender remote code execution, listed as Critical by BleepingComputer.

Tenable also lists twelve Windows elevation of privilege flaws at CVSSv3 7.8, all marked More Likely, in components including Windows Installer, WMI, the kernel, the Print Spooler, the AppX Deployment Service, Winlogon and the Telephony Service. These are the typical post-compromise bugs that ransomware crews chain with a phishing foothold.

Background

Microsoft's monthly counts have been climbing for most of 2026. Early in the year the totals were small: Tenable's February write-up counted 54 CVEs and its June write-up 198. Later months reported far higher figures. Trade outlets put September at roughly 964 to 973 CVEs and October at roughly 1,407 to 1,413, with differing counts by outlet again; we have not verified those against Microsoft's own tallies, so treat them as approximate. The trend, rather than any single total, is what matters: security teams are being asked to absorb a volume of fixes that would have been unthinkable a year ago.

NTLM, the older Windows challenge-response sign-in protocol, is a recurring theme. A flaw that makes a program reach out to an attacker's server is dangerous mainly because Windows may send the user's NTLM credentials along, and those hashes can be cracked or relayed. Microsoft has been tightening NTLM in steps. According to Windows Forum, the October 2026 update blocked NTLMv1-derived credentials for single sign-on by default on 24H2, 25H2, 26H2 and Windows Server 2025 when Credential Guard is off, which could affect Wi-Fi, Ethernet and VPN connections using MS-CHAPv2. We covered another November change that touches Windows trust, the removal of seven eMudhra certificates in KB5134133 and, because Edge is built on Chromium, our report on the Chrome zero-day fix is relevant to it too.

The numbers

BleepingComputer's category table for the month shows how much of the volume is privilege escalation rather than remote code execution. Its categories add up to 1,226 rather than 1,235, so read it as the shape of the month, not an exact ledger.

Elevation of Privilege536

Remote Code Execution296

Information Disclosure157

Edge (Chromium-based)142

Denial of Service46

Security Feature Bypass27

Spoofing22

November 2026 Patch Tuesday flaws by type (BleepingComputer's count; categories sum to 1,226 of 1,235) (flaws)

	flaws
Elevation of Privilege	536
Remote Code Execution	296
Information Disclosure	157
Edge (Chromium-based)	142
Denial of Service	46
Security Feature Bypass	27
Spoofing	22

Source: BleepingComputer, Microsoft November 2026 Patch Tuesday

Tenable's view, by product, is different and more useful for deciding what to test first. Office applications and SQL Server dominate:

Microsoft Office Word65

Microsoft Office Excel64

SQL Server53

Windows Advanced Rasterization Platform37

Windows Installer36

Windows Graphics Kernel35

Windows Kernel28

Microsoft Office SharePoint27

Windows DNS22

Microsoft Office Outlook20

Windows Print Spooler Components20

Most-patched products, November 2026 (Tenable's count of 1,093 CVEs) (CVEs)

	CVEs
Microsoft Office Word	65
Microsoft Office Excel	64
SQL Server	53
Windows Advanced Rasterization Platform	37
Windows Installer	36
Windows Graphics Kernel	35
Windows Kernel	28
Microsoft Office SharePoint	27
Windows DNS	22
Microsoft Office Outlook	20
Windows Print Spooler Components	20

Source: Tenable, November 2026 Microsoft Patch Tuesday

Tenable's impact split is 48.9% elevation of privilege and 27.1% remote code execution, which lines up with BleepingComputer's ordering even though the totals differ.

How the update changes Windows

NTLM signing. Per Microsoft's KB5132061 notes, clients now offer NTLM message signing by default for non-anonymous connections, which reduces exposure to relay attacks, and Windows adds auditing for connections that do not use signing. Treat the audit events as a migration list: every connection that cannot sign is a place NTLM is still in use and could be relayed. Test single sign-on and any Wi-Fi, Ethernet or VPN connection using MS-CHAPv2, especially where Credential Guard is off.

PowerShell signatures. Microsoft's notes say signature verification now applies stricter encoding validation, so signed scripts with invalid UTF-8 may fail validation. The fix is to re-save the script as UTF-8 with a byte order mark and sign it again. Windows Forum lists the usual causes: curly quotes, em-dashes and non-breaking spaces pasted in from email, web pages or Word, and source-control or editor tooling that re-encodes files. Run signature validation over your signed scripts after installing, and check any build pipeline that might re-encode them, because the problem can return.

Everything else. KB5132061 also fixes error 87 when adding Active Directory-published printers, USB Audio 1.0 devices showing Code 10, and RDP client connection failures caused by a certificate mismatch after the October preview update; the 24H2 build additionally fixes HDMI and DisplayPort audio failures on some AMD graphics cards. It expands device targeting for the new Secure Boot certificates, with deployment continuing over the coming months, and adjusts Cuba's daylight saving rules so the country stays on UTC-04:00 and skips the November 2026 and March 2027 clock changes. BleepingComputer's coverage of the Windows 10 update (build 19045.7846, and 19044.7846 for Enterprise LTSC 2021) lists much the same fixes, plus a repair for RDS shadow connection failures on Windows Server 2016 and 2012 R2 after the 14 October update.

What it means

For administrators, the zero-day is rated Moderate, and that rating is the reason it is easy to under-prioritise. A hash leak needs a user to open a file, but credential theft is how many intrusions start, and an exploited bug is by definition being used. Push Outlook and Office updates in the same window as Windows, not in the next one.

For security teams, the sheer volume pushes risk-based triage. Exploitation labels ("More Likely") and exposure matter more than raw severity: the Schannel flaw is unauthenticated over the network, and the Active Directory and Exchange bugs sit on systems most organisations cannot afford to leave open. The record totals also have a cost: more fixes mean more regression risk, which is why the install-error reports and the NTLM and PowerShell changes deserve a pilot ring.

For developers, the PowerShell change is the one most likely to cause a surprise on Monday morning: a signed deployment script that worked on Friday can fail validation after the update because of one pasted character. And Tenable's note that the zero-day credit went to a researcher who used an LLM is another data point on how AI-assisted vulnerability research is feeding patch volumes.

What we don't know yet

• Which count is Microsoft's. We could not read the Security Update Guide, so we cannot reconcile 1,235 and 1,093.
• How the Outlook flaw is being used. The sources do not say who is exploiting CVE-2026-124194, how widely, or which Outlook builds are affected, and BleepingComputer's page does not list affected versions.
• How common the install failures are. The Neowin-reported errors 0x800f0993 and 0x800f0989 are unquantified.
• Whether Microsoft will add known issues. The company says it is not aware of any for KB5132061 today; that often changes within days.

What to watch next

Microsoft's Security Update Guide entry for CVE-2026-124194 and any CISA addition of it to the Known Exploited Vulnerabilities list; the release health dashboard for KB5132061 known issues; the December 2026 Patch Tuesday, which will show whether the month-on-month climb continues; and the next stage of NTLM hardening after this month's signing default.

Sources

• BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
• Tenable: Microsoft's November 2026 Patch Tuesday addresses 1,093 CVEs (CVE-2026-124194)
• Microsoft Support: KB5132061
• Microsoft Security Update Guide: CVE-2026-124194
• BleepingComputer: Windows 10 KB5131096 extended security update
• BleepingComputer: Windows 11 KB5132061 and KB5131087 cumulative updates
• Windows Forum: Windows 11 November 2026 Patch Tuesday, PowerShell signing changes and NTLM hardening