Microsoft's November 2026 Patch Tuesday fixes 1,094 flaws, including an exploited Outlook bug
Microsoft's 10 November 2026 Patch Tuesday update for Windows 11 fixes 1,094 vulnerabilities by Microsoft's count, including an Outlook spoofing flaw already exploited, and adds a customizable right-click menu.
1 / 2
The story, neutrally told
Centre · 1Microsoft's November 2026 Patch Tuesday update for Windows 11, labeled 2026-11 Security Update (KB5132061) (26300.9974), resolves 1,094 security vulnerabilities according to Microsoft, 63 of them rated critical and one already exploited in the wild. ZDNETN “This month’s update resolves 1,094 security vulnerabilities, according to Microsoft, with 63 of them rated critical and one already exploited in the wild.”““2026-11 Security Update (KB5132061) (26300.9974)”” Read at ZDNET ↗ Centre · 1The exploited flaw is a spoofing vulnerability in Microsoft Outlook: a remote attacker who sends a malicious email and persuades the recipient to open it could make Outlook connect to an attacker-controlled network, with no warning, potentially exposing the user's username and password. ZDNETN “a remote attacker who sends you a malicious email and convinces you to open it could cause Outlook to connect to a network controlled by that attacker”“the exploit might reveal your username and password to the sender” Read at ZDNET ↗ Centre · 1Computerworld identifies it as CVE-2026-124194 and advises deploying the Outlook fix first. It also says a Chromium flaw, CVE-2026-125350, is being exploited and that, at the time of writing, Microsoft had fixed it only in Edge for Android. ComputerworldN “attackers are already using CVE-2026-124194, a spoofing flaw.”“at the time of writing, Microsoft has fixed it only in Edge for Android”“Deploy the Outlook fix first.” Read at Computerworld ↗
Centre · 1Computerworld's own count is 1,240 CVEs, 64 of them critical: Microsoft's 1,094 plus 165 republished Chromium fixes, minus 19 Azure and open-source entries. Its breakdown puts Windows at 744 CVEs (37 critical), Office at 204 (22 critical), developer tools at 50 (all important), and Exchange at one critical CVE. ComputerworldN “Our count takes Microsoft's 1,094 CVEs, adds 165 republished Chromium fixes and leaves out 19 Azure and open-source entries.”“Windows has 744 CVEs this month, 60% of the total, and 37 of them are critical.”“Microsoft Office has 204 CVEs this month: 22 critical, 181 important and one moderate.” Read at Computerworld ↗ Centre · 2Both outlets note the total is below October's, which ZDNET puts at a record 1,400 patches. ZDNET ties the volume to Microsoft and other vendors relying on AI to find and fix security holes, and Computerworld says AI has brought an "age of vulnerability". ZDNETN “That’s fewer than October’s record of 1,400 patches.” Read at ZDNET ↗ ComputerworldN “We have now officially entered the age of vulnerability, and AI handed us the receipts.” Read at Computerworld ↗ Centre · 1For features, ZDNET calls a customizable File Explorer right-click menu the star of the update; it is a gradual rollout, with a Customize menu entry or a Context menu page under Settings > Personalization. A Cloud rebuild recovery option, which reinstalls Windows 11 from cloud images but does not preserve files, is also rolling out gradually. ZDNETN “Though the customizable right-click menu is the star of the update”“Cloud rebuild is a new recovery option that lets you reinstall Windows 11 via cloud-based system images and drivers downloaded from Windows Update.”“The downside is that your files won’t survive.” Read at ZDNET ↗
Centre · 1On support, ZDNET says monthly updates fully support Windows 11 26H2 and 25H2. Support for 24H2 Home and Pro ended last month, 24H2 Enterprise and Education still get security updates, and 23H2 Enterprise and Education get no updates after this month. ZDNETN “Microsoft’s monthly updates fully support Windows 11 26H2 and 25H2. But support for 24H2 ended last month, at least for the Home and Pro editions.”“Windows 11 23H2 Enterprise and Education will receive no more updates after this month.” Read at ZDNET ↗ Centre · 1Computerworld reports no known issues for the three November Windows 11 updates (KB5132061, KB5132059 and KB5131087), though a WSUS issue on Windows Server 2025 and 2022, which hides synchronization error details, remains open with no published workaround. ComputerworldN “the November Windows 11 updates list no known issues. The three updates are KB5132061, KB5132059 and KB5131087.”“WSUS still hides synchronization error details on Windows Server 2025 and 2022.” Read at Computerworld ↗ Centre · 1Computerworld also says Microsoft changed 18 CVE records within 11 hours of release, including CVE-2026-95885 in Windows Client for NFS, now classed as remote code execution though its title still says elevation of privilege. It advises Exchange 2016 and 2019 users, for whom there is no update, to upgrade, quoting Microsoft calling those versions "permanently vulnerable". ComputerworldN “Microsoft has already changed this November release too, altering 18 CVE records within 11 hours.”“you should consider them permanently vulnerable and should upgrade your organization immediately.” Read at Computerworld ↗
Every sentence links to the reporting it rests on. The pill in front of each says where its sources sit: Left, Centre or Right when one side supplies at least half of them, Mixed when they are evenly split. The number is how many outlets it cites.
Left0 outlets
No left outlet in our sources has covered this story yet.
Centre2 outlets
- Framing
- ZDNET writes a consumer-facing update guide leading with the customizable right-click menu and then the security fixes; Computerworld writes an administrator's deployment to-do list starting with the Outlook flaw.
- Emphasis
- ZDNET: new features, how to install, support lifecycle. Computerworld: patch priorities, exploited flaws, known issues, revisions and end-of-support dates.
- Leaves out or plays down
- ZDNET gives no CVE identifiers and little on exploited flaws beyond Outlook; Computerworld says little about the new Windows 11 features.
- Charged language
- “age of vulnerability”“permanently vulnerable”“star of the update”
- For example
-
“Though the customizable right-click menu is the star of the update” — ZDNET
“Start with Outlook: attackers are already using CVE-2026-124194, a spoofing flaw.” — Computerworld
Right0 outlets
No right outlet in our sources has covered this story yet.
What every side reports
- Microsoft's November 2026 Patch Tuesday was on 10 November and fixes 1,094 CVEs by Microsoft's count.
- One Outlook spoofing flaw is already exploited.
- The total is lower than October's.
Where accounts differ
-
Number of vulnerabilities and critical ratings
- Centre
- ZDNET gives Microsoft's figure of 1,094 flaws with 63 critical; Computerworld reports its own count of 1,240 CVEs with 64 critical, adding 165 republished Chromium fixes and excluding 19 Azure and open-source entries.
Microsoft organisation
Microsoft counts 1,094 vulnerabilities fixed, ships new Windows 11 features, and in its release note calls unsupported Exchange 2016 and 2019 "permanently vulnerable".
“This month’s update resolves 1,094 security vulnerabilities, according to Microsoft” — ZDNET
“you should consider them permanently vulnerable and should upgrade your organization immediately.” — Computerworld
Left0 articles
No coverage yet.
Centre2 articles
-
ZDNETN ·
New Windows 11 update fixes File Explorer menu mess – and patches an exploited flaw
Neutral Practical consumer guide putting the new right-click menu first and the exploited Outlook flaw later.
-
For November, Patch Tuesday means a to-do list that starts with Outlook
Mixed Admin-oriented patch triage that leads with the exploited Outlook flaw and closes with a reflective note on AI-driven vulnerability volume.
Right0 articles
No coverage yet.
- 10 Nov 21:00 First ZDNETN New Windows 11 update fixes File Explorer menu mess – and patches an exploited flaw
- 13 Nov 12:09 +63h 9m ComputerworldN For November, Patch Tuesday means a to-do list that starts with Outlook
Times are when each article was published, or when we first saw it if the outlet gave no time.
Ask about this story
Loading…