Microsoft's November Patch Tuesday fixes an actively exploited Outlook spoofing flaw
Organisations running Windows 11 23H2 Enterprise or Education editions will receive no further monthly security updates after this release.
Microsoft's November 2026 Patch Tuesday closes more than a thousand security gaps across its product line, though outlets disagree on the exact count, ranging from 1,094 to 1,259. The headline fix is an Outlook spoofing flaw, CVE-2026-124194, that Microsoft says attackers were already exploiting; it can leak a user's NTLMv2 hash when a crafted message file is opened, and it does not fire through the Preview Pane. The bug is rated Moderate with a CVSS score of 6.5, which some security researchers argue understates the risk given how widely Outlook is deployed. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by November 24, 2026. Windows accounted for the largest share of fixes, and this release also ends monthly security updates for the Enterprise and Education editions of Windows 11 version 23H2.
Why it matters
The Outlook flaw is already being exploited and can expose a user's NTLMv2 hash when a crafted message file is opened, even without the usual external-content warning, so affected users are at risk before they have patched. Federal agencies are required to patch by November 24, 2026, following CISA's listing. For Windows 11 23H2 Enterprise and Education customers, this release is the last monthly security update they will receive, so they must plan a move to a supported version.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.