Security alert · 11 November 2026

1,094 Microsoft fixes and an Outlook zero-day: what small businesses should patch first

By Hasan, Co-founder, Excelytech · November 11, 2026

On 10 November 2026, Microsoft shipped fixes for about 1,094 security flaws in one day. One of them, in Outlook, was already being used by attackers. It is the second month in a row above 1,000. No small IT team can test 1,094 patches by Friday, so here is what matters, in plain English, and the order to do it in.

What happened this week

Patch Tuesday is the second Tuesday of every month, when Microsoft releases its security updates. A normal month a couple of years ago meant around a hundred fixes. That has changed fast in 2026:

• October 2026 set the record, with more than 1,400 fixes.
• November 2026 followed with about 1,094, the second month in a row above 1,000.
• Microsoft has now fixed more than 5,000 vulnerabilities this year.

Different trackers count slightly differently. Tenable and Rapid7 count about 1,093 and 1,092 Microsoft CVEs, SecurityWeek and The Register say 1,094, and some outlets that include re-published third-party bugs report more than 1,200. Every count agrees on the important part: more than 60 rated Critical and one exploited zero-day.

Why so many?

Microsoft has not said. Many researchers point to AI-assisted bug hunting. Dustin Childs of the Zero Day Initiative told The Register that the volume "proves automated bug-hunting has permanently reset patch volume". This month's zero-day itself was credited to a researcher who found it using Anthropic's Claude.

The same tools work for attackers. Childs warned that AI makes it near-instant to compare a patch with the old code and build an exploit, so "the threat window opens the minute these updates drop." Last month showed what that looks like: a SonicWall remote access flaw was fixed on 6 October and attack attempts reached honeypots two days later.

If this sounds familiar, it should. In October, AI-found flaws in PHP pushed governments to take websites offline. The pattern is the same: more bugs, found faster, exploited sooner.

The Outlook zero-day, in plain English

CVE-2026-124194 is the one bug in this release that attackers were already using. Microsoft calls it a "spoofing" flaw and rates it Moderate (CVSS 6.5). Do not let the label slow you down.

1. An attacker sends a crafted message file, usually by email.
2. A user opens it. (The Preview Pane alone does not trigger it.)
3. Outlook quietly connects to a server the attacker controls, without the usual external-content warning.
4. Windows sends that server the user's NTLMv2 hash, a scrambled form of their login.
5. The attacker cracks the hash offline, or relays it to log in as that user on another system that does not require signing.

"Attackers are already exploiting it, it needs only one click on an email file, and it hits Outlook, which nearly every organization runs," Jack Bicer of Action1 told Infosecurity Magazine. If the person who clicks is an administrator or your bookkeeper, one stolen login is often all an attacker needs to start a ransomware attack or invoice fraud.

Watch out: the fix is in the Office updates, not the Windows cumulative update. A PC can show "Windows is up to date" and still run a vulnerable Outlook. Microsoft has not said who is behind the attacks or how widespread they are.

The other bugs that matter for a typical business

Most of the 1,094 are "Important" bugs that need an attacker already inside. These are the ones to move up the list:

Childs counts about 30 bugs in this release that need neither a login nor a click over a network. Those are the ones worms are made of.

On Azure? Critical fixes also landed for Azure OpenAI and Azure Managed Grafana. Microsoft fixes most cloud service bugs on its side, but Windows virtual machines you run in Azure are still yours to patch.

What to patch first

You cannot test 1,094 updates this week, and you do not need to. Sort by what is exploited and what faces the internet, not by the score alone.

Step 1: Get Outlook updated everywhere, today

Push the Office update to every machine that runs Outlook. Start with administrators, owners, finance and anyone who handles payments. Then check: in Outlook, go to File > Office Account > Update Options > Update Now, and confirm in your management tool (Intune or your RMM) that the Office build actually changed.

Step 2: Make stolen hashes less useful

These steps blunt this zero-day and the next one like it:

• Block outbound SMB (TCP port 445) at your firewall. Office PCs should not be connecting to file shares on the internet.
• Turn on SMB signing and LDAP signing, and Extended Protection for Authentication on Exchange, so a captured hash cannot simply be relayed.
• Put administrator accounts in the Protected Users group in Active Directory.
• Make sure multi-factor authentication is on for email and remote access. It will not stop a hash relay inside your network, but it stops many follow-on logins from outside.

Step 3: Patch domain controllers and Exchange, with a way back

These are the servers you can least afford to break. Take a backup, confirm it restores, patch one server, check that logins and mail work, then do the rest. For Exchange, install the Windows update and the Exchange update. Note that only Exchange Server Subscription Edition still gets fixes; older on-premises Exchange versions are past end of support.

Step 4: Check that it actually worked

"We pushed the updates" is not the same as "we are patched". Confirm with at least two signals, such as your device management console and a vulnerability scan. Look for machines that were off, travelling or stuck on a reboot.

Also ending this month

This release was the last security update for some widely used software. If you still run any of these, plan a move now:

• Windows 11 version 23H2, Enterprise and Education editions
• .NET 8 and .NET 9
• PowerShell 7.4

Custom business apps built on .NET 8 are common. If a developer built your internal software a few years ago, ask which .NET version it runs on.

Patching is now a monthly fire drill. Plan for it.

The volume is not going back down

Two months above 1,000 fixes is a new normal, not a spike. Businesses that patch "when someone gets to it" will fall behind every month. The fix is a routine: a test group of PCs that updates first, a set day for servers, and someone accountable for checking the result.

Fewer servers means fewer patches

Every on-premises Exchange server, file server and old Windows box is one more thing to patch on Patch Tuesday. Moving mail to Exchange Online and suitable workloads to Azure hands much of that server patching to Microsoft. It does not remove patching completely, since PCs, Office apps and any virtual machines you run are still yours, but it shrinks the list a lot.

A patch can break things. A tested backup is your undo button.

With this many changes in one release, some updates will cause problems somewhere. The businesses that patch quickly are the ones that know they can roll back. If you are not sure your backups would restore a domain controller or a line-of-business server today, that is the gap to close first.

Sources

• Microsoft Security Update Guide
• SecurityWeek: Exploited Outlook zero-day among 1,094 flaws patched by Microsoft
• The Register: November Patch Tuesday boasts over 1,000 bugs
• Tenable: November 2026 Patch Tuesday addresses 1,093 CVEs
• Rapid7: Patch Tuesday, November 2026
• SOCRadar: November 2026 Patch Tuesday, 1,094 flaws, one exploited
• Infosecurity Magazine: Microsoft fixes 1,235 flaws
• Notebookcheck: Outlook zero-day found by a researcher using Claude
• Cloud Security Alliance: Patch volume saturation and AI discovery
• Canadian Centre for Cyber Security: Alerts and advisories

This article reflects public information as of 11 November 2026. Vulnerability counts differ between trackers; check Microsoft's Security Update Guide for the definitive list.