Covered by 7 outlets — first reported by BleepingComputer, Nov 10, 19:07 UTC
Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
MentionsMicrosoftMicrosoft WindowsGoogleGoogle ChromeMicrosoft Azure
Summary
Microsoft released its November 2026 Patch Tuesday security updates, which include a fix for an Outlook zero-day (a flaw exploited before a fix existed) that Microsoft says is under active exploitation. The Outlook flaw is tracked as CVE-2026-124194. Counts of the fixes differ by source: BleepingComputer and Infosecurity Magazine count 1,235 flaws, the SANS Internet Storm Center 1,260, SecurityWeek and CyberScoop 1,094, and Rapid7 1,092 Microsoft-product vulnerabilities. CyberScoop says Windows accounts for 726 of the listed CVEs and Office 174.
AI summary by the SecurityTabs newsroom, checked against BleepingComputer, US-CERT / SANS Internet Storm Center, SecurityWeek, CyberScoop, Rapid7 Blog, Infosecurity Magazine. Read the outlets below for the full story.
Continue reading
7 outlets, in the order they reported it.
BleepingComputerFirst report
Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability.
US-CERT / SANS Internet Storm Center
Microsoft Patch Tuesday November 2027 , (Tue, Nov 10th)
Microsoft continues its AI-induced patch surge, addressing 1,260 different vulnerabilities this month. 68 of these vulnerabilities are considered critical. 167 of the vulnerabilities are Chromium issues affecting Microsoft Edge.
SecurityWeek
Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation.
CyberScoop
Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday
Microsoft’s November security update addresses roughly 1,090 vulnerabilities across Windows, Office, Azure and the company’s other product lines, the second consecutive monthly release to exceed the totals of all previous years.
Rapid7 Blog
Patch Tuesday - November 2026
Microsoft is publishing 1,092 own-product vulnerabilities on November 2026 Patch Tuesday, including 1,102 vulnerabilities in Windows.
Security Affairs
Microsoft November Patch Tuesday: one exploited Outlook bug and 30 wormable flaws
Microsoft November Patch Tuesday security updates fix 1,090 flaws, including one exploited Outlook bug and 30 potentially wormable issues.
Infosecurity Magazine
Microsoft Fixes 1235 Flaws in Another Record Patch Tuesday
Microsoft patched a record-breaking 1235 CVEs in November’s Patch Tuesday
Explained
The technology and terms in this story. Learn more
- ConceptPatch TuesdayMicrosoft's monthly security update day, the second Tuesday of every month.
- ConceptZero-dayA flaw attackers exploit before the vendor has a fix: defenders have had zero days to patch.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.