Microsoft November 2026 Updates: Exploited Outlook Flaw and KBs

On 10 November 2026 (11 November in Japan), Microsoft released its monthly security updates. They cover 1,094 vulnerabilities in Microsoft products, including Windows, Office, Exchange Server and SQL Server. One of them, an Outlook flaw (CVE-2026-124194), is already being used in attacks.

Japan's IPA and JPCERT/CC issued alerts the same day, urging organisations to update quickly. This article covers what to check first this month, the update numbers for each product, and the steps to update your PCs and servers.

The exploited Outlook flaw

According to Microsoft, CVE-2026-124194 works like this. An attacker sends a crafted message file. When the user opens it in Outlook, Outlook connects to a server the attacker controls, without the usual warning. This can hand the user's NTLMv2 hash to the attacker, who can use it to log in as that user.

• Microsoft rates it Moderate, with a CVSS score of 6.5. The number is not high, but real attacks have been seen.
• The user has to open the file. Microsoft says the Preview Pane is not an attack vector.
• CISA added it to KEV on 10 November and gave US federal agencies until 24 November to act.

Alongside the update, the following general measures also help. Microsoft did not list them for this flaw; they are common defences against attacks that steal NTLM hashes.

• Block outbound file-sharing traffic (SMB, TCP port 445) to the internet at the firewall
• Remind staff not to open unexpected attachments or message files
• Don't read everyday email with administrator accounts

Server flaws to fix first

None of these are known to be exploited yet. We picked the ones that can be attacked without logging in, or that Microsoft rates "Exploitation More Likely".

Note: Outlook also gets fixes for code execution flaws that can be triggered through the Preview Pane (CVE-2026-110043 and others).

Updates (KBs) by product

These are the updates and resulting build numbers for the main products, taken from Microsoft's published data. If the build shown by the winver command is this number or newer, the update is installed.

Note: Windows Server 2025 also has a "hotpatch" version that needs fewer restarts. For SQL Server, the update you need depends on your servicing path (CU or GDR).

Five steps to respond

1. List your PCs and servers

   Note the Windows version, the type of Office, and whether you run Exchange Server or SQL Server. If you deploy updates through Windows Update, Intune or WSUS, check their status too.

2. Update PCs that use Outlook first

   Because the flaw is being exploited, update Office quickly. For Microsoft 365 Apps, check that automatic updates have not been turned off.

3. Update internet-facing servers

   Prioritise Exchange Server, IIS and domain controllers. If you have a test environment, install there first and check that everything works.

4. Restart

   IPA notes that a restart may be needed after updating. Putting it off leaves the fix inactive.

5. Confirm the updates installed

   Compare build numbers with the table above. For machines that failed, find the cause and install manually.

Watch out for unsupported products

These products reached end of support on 14 October 2025. They get no update this month, or only with a paid extension.

If you still run older products, see "security for old systems". For .NET, see ".NET 8 and 9 end of support".

Doing nothing vs. acting now

Let Digi Dinos help

Digi Dinos supports companies with DX, security, and system operations and maintenance. We are ISO 27001 certified and offer server and cloud operations and 24/7 monitoring (NOC). Our team works with you in Japanese.

• Monthly update operations: we check, test, install and report on updates with a fixed procedure.
• Server inventory: we list Windows Server, Exchange and SQL Server versions and their support dates.
• Operations takeover: we can take over systems whose staff have left or that another company managed.

If a handover is the problem, see "taking over system maintenance".

Frequently asked questions