Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day

Microsoft's November 2026 Patch Tuesday security updates address a record-breaking 1,235 flaws, including an actively exploited Microsoft Outlook zero-day vulnerability that can be used to steal NTLM account hashes. The update includes 66 "Critical" vulnerabilities, with 48 being Remote Code Execution flaws. The actively exploited Outlook zero-day is a spoofing vulnerability where opening a malicious file causes Outlook to connect to an attacker-controlled network location, potentially disclosing authentication information that could be used to impersonate the user. This Patch Tuesday follows October's record of 1,411 flaws, as Microsoft continues using AI to find and patch vulnerabilities. The total excludes 108 flaws fixed earlier this month, and other vendors including Cisco, Google, and SAP also released security updates in November.