If you use Microsoft Windows, Edge, or Outlook, this month's Patch Tuesday deserves your attention. Microsoft released fixes for about 1,235 security holes in a single day, and one of them, an Outlook flaw, is already being used by criminals to steal Windows passwords just by getting someone to open the wrong email file. On top of that, 66 holes are rated critical, and vendors including SonicWall, Ivanti, Zyxel, Cisco, Barracuda, and Google pushed urgent fixes of their own, some for flaws already under attack. Here is what matters in plain English, what to update this week, and how to tell whether your computers are really protected.

November 2026 Patch Tuesday by the Numbers

Microsoft fixed about 1,235 flaws on Patch Tuesday itself, and about 639 of them touch Windows. That count does not include roughly 180 more fixes released earlier in the month, 25 of them in Microsoft Edge.

By type, the fixes break down like this:

  • About 536 let an attacker go from limited access to complete control of a computer.
  • About 296 let an attacker run their own malicious code from across the network.
  • About 157 leak private information.
  • 66 are rated critical, which means "do this now."

Microsoft is using artificial intelligence to find and fix more flaws, which is one reason these monthly totals have stayed above 1,000 for months.

Why No One Can Patch 1,000+ Flaws by Hand

No person can check a thousand boxes by hand. There is always a gap between the day a fix comes out and the day it is installed and confirmed on every computer, and that gap is where criminals live.

What business owners need

If you own a business, you need a system that installs updates automatically, checks that they finish, and flags the computers that got missed. This is the core of patch management with A Faster PC's managed IT services and it is the difference between hoping updates happened and knowing they did.

What home users need

If you are a home user, make sure Windows updates are not paused, and restart whenever your computer asks.

The Outlook Flaw Already Under Attack

The one flaw confirmed under active attack this month is an Outlook vulnerability tracked as CVE-2026-124194.

How the attack steals your Windows password

An attacker sends a specially crafted message file. If you open it, Outlook can quietly connect to a computer the attacker controls without showing the usual warning about outside content. Security reporters at BleepingComputer say attackers use this to steal NTLM hashes, which are scrambled versions of your Windows password.

Once criminals capture that scrambled version, they can try to crack it on their own computers until they recover your real password. Then they can try that password on your email, your file shares, and your business logins.

Why a "Moderate" rating can be misleading

The attack needs two things to work: network access and someone opening the file. That makes it a phishing problem at heart. Microsoft rates it only Moderate, which shows that a severity label does not tell you the real-world risk. This is also the second month in a row that criminals have gone after the warnings that are supposed to protect you; last month's zero-day also stripped away a safety warning.

What to do this week

  • Install this month's Windows and Office updates now, and do not put it off.
  • Until you do, be careful with unexpected message files or attachments, even if they look like they came from someone you know.
  • Business owners: ask whoever handles your IT whether outbound file sharing traffic is blocked at the firewall. That limits this kind of password theft.
  • Home users: install the update and do not open odd attachments to "double-check" them.

Critical Holes Business Owners Should Not Ignore

None of the following flaws are confirmed under attack in this report, but they sit in places criminals love, so they belong on your patch-now list.

  • Business logins: The system that handles logins on most business networks has two critical holes, one that could let an attacker run code and one that could let them take complete control.
  • Exchange Server: Many businesses still run their own Exchange Server for email, and it has a critical hole. This is the fourth Patch Tuesday in a row, August through November, where Exchange has shown up. If you run your own Exchange Server, put it at the top of your list.
  • Microsoft Defender: Defender itself has a critical security hole. Your protection needs protection.
  • Windows file sharing: File sharing has a critical hole, plus another in how Windows handles login credentials. If you share files between computers, this matters to you.
  • Hyper-V: Eight critical holes affect anyone running virtual computers.
  • Microsoft Office: A fresh round of critical Office fixes includes Outlook, Word, PowerPoint, and Office itself.
  • Deeper in Windows: Critical fixes cover Windows Search, codecs, library development services, graphics, fonts, and two function discovery components.

Even Important-rated bugs in Windows DNS and Remote Desktop matter on a business network. Important does not mean harmless; it means one step below critical.

The bottom line for owners: you do not need to memorize these numbers. You need to know that logins, email, file sharing, and Office are all on the patch-now list.

The Exact Windows Updates to Look For

Microsoft shipped these updates this month:

  • Windows 11: KB5132061 and KB5131087
  • Windows 10 Extended Security Updates: KB5131096

How to check at home

Open Settings, go to Windows Update, click Check for updates, and restart when it asks. Then open your Office apps and let those updates finish too. Not sure which version of Windows you run? Click Start, type winver, and press Enter.

What businesses need to verify

For businesses, it is not enough to hope updates happened. You need an inventory showing which computers run Windows 10, which run Windows 11, and whether this month's update finished on all of them.

Windows 11 version 23H2 gets its last update

Windows 11 version 23H2 Enterprise, Education, and IoT editions get their last update this month. If you have those machines, confirm this update installs and plan the move to a supported version of Windows 11 now.

If you would rather not take all of this on yourself, this is exactly what a managed services provider does: makes sure updates are installed, verifies them, and catches the ones that silently fail.

Other Vendors With Urgent Fixes This Month

BleepingComputer listed a long run of other vendors with security updates this month, and several flaws are already being exploited:

  • Ivanti: Fixed two Connect Secure flaws attackers have exploited as zero-days since October 1. Researchers say attackers gained full system control even on fully patched devices, used no malware, and tampered with logs, so a clean scan does not prove you are clean.
  • SonicWall: Fixed seven SonicOS flaws, including a VPN bypass that can defeat login protection and is already being exploited. SonicWall says there is no workaround, so you must update.
  • Zyxel: Patched a zero-day in its GS1900 switches that was used to take over nearly a thousand devices.
  • Cisco: Released critical fixes for Catalyst SD-WAN, Secure Email Gateway, and Meraki.
  • Barracuda: Fixed two flaws that allow full system control, which were exploited about a week later.
  • Google Chrome: An emergency update fixes a zero-day already under attack. Update Chrome today.
  • Vates: Fixed a critical Xen Orchestra login bypass under active exploit.
  • SAP: Included four maximum-severity fixes.
  • N-able: Is working on a hotfix for an allegedly publicly disclosed zero-day in N-central and took hosting systems offline, so watch its advisories.
  • Linux: Systems are getting fixes for an OpenSSH login bypass nicknamed SSHole.

If your business or your IT provider runs any of these, confirm the patches were applied, not just downloaded.

The Short Version

  • Microsoft fixed about 1,235 flaws this Patch Tuesday.
  • One Outlook flaw is under active attack and steals passwords.
  • Critical holes affect logins, email, file sharing, and Office.
  • Urgent fixes arrived from Ivanti, SonicWall, Zyxel, Cisco, Barracuda, Google Chrome, and more.
  • Install this month's Windows, Office, and Chrome updates this week, and verify they finish on every computer.

Every month we see computers that do not have all of their Windows updates installed. Does your business have a system that confirms updates installed on every computer, or are you just trusting that they did? You can catch the full monthly breakdown on A Faster PC Live Technical Support along with our weekly cybersecurity videos.

Frequently Asked Questions About the November 2026 Patch Tuesday

What did Microsoft fix in the November 2026 Patch Tuesday?

Microsoft fixed about 1,235 security flaws on Patch Tuesday, and about 639 of them affect Windows. That does not count roughly 180 more fixes released earlier in the month, including 25 in Microsoft Edge. Sixty-six of the flaws are rated critical, and one Outlook flaw is confirmed under active attack, so install this month's Windows and Office updates this week.

How does the Outlook vulnerability steal Windows passwords?

An attacker sends a specially crafted message file. If you open it, Outlook can quietly connect to a computer the attacker controls without showing the normal warning about outside content. According to BleepingComputer, attackers use this to capture NTLM hashes, which are scrambled versions of your Windows password, and then try to crack them and reuse the password on your email, file shares, and business logins.

Is the Outlook flaw dangerous if Microsoft only rated it Moderate?

Yes. It is confirmed under active attack, which shows a severity label does not tell you the real-world risk. The attack needs network access and someone opening the file, so it is really a phishing problem. Install the update and avoid opening unexpected message files or attachments, even from people you know.

Which Windows updates should I look for this month?

For Windows 11, look for KB5132061 and KB5131087. For Windows 10 computers on Extended Security Updates, look for KB5131096. At home, open Settings, go to Windows Update, click Check for updates, and restart when asked, then open your Office apps so their updates finish too.

How do I know if Windows updates actually installed on every business computer?

You need an inventory that shows which computers run Windows 10 or Windows 11 and whether this month's update finished on each one. A good patch management system installs updates automatically, checks that they finish, and flags the computers that got missed. That is exactly what a managed services provider does.

Is Windows 11 version 23H2 still getting security updates?

Windows 11 version 23H2 Enterprise, Education, and IoT editions get their last update this month. If you have those machines, confirm this month's update installs and plan the move to a supported version of Windows 11. To check your version, click Start and type winver.

Which other vendors released urgent security fixes in November 2026?

Ivanti, SonicWall, Zyxel, Cisco, Barracuda, Google Chrome, Vates, SAP, and OpenSSH on Linux all released important fixes, and several flaws were already being exploited. SonicWall says its VPN bypass has no workaround, and Google pushed an emergency Chrome update for a zero-day under attack. If you or your IT provider runs any of these, confirm the patches were applied, not just downloaded.

Who can manage Windows updates and patching for my business on the Treasure Coast, Space Coast, or South Florida?

A Faster PC is a managed services provider serving Florida's Treasure Coast, Space Coast, and South Florida. We install and verify Windows, Office, and third-party updates on every computer and catch the ones that silently fail. Call 772-878-5978 or download our free cybersecurity report at https://afasterpc.com/new-cybersecurity-crisis/ to see where small businesses get caught.

About A Faster PC

A Faster PC is the leading managed services provider (MSP) serving Florida's Treasure Coast, Space Coast, and South Florida. A Faster PC provides responsive IT support, advanced cybersecurity solutions, cloud backup, disaster recovery, breach remediation, patch management, computer repair, and technical support for accounting offices, attorneys' offices, medical offices, dental offices, professional offices, small- to medium-sized businesses, non-profits, churches, home office users, and individuals throughout the regions. We help our clients cut costs in their Internet, TV, and telephone bills and in business operations.

Every week at 10:07 AM EST, A Faster PC hosts A Faster PC Live Technical Support, which is a live Radio Show that is livestreamed to YouTube and Facebook and is available as a podcast. Visit our Live Technical Support page for various ways to schedule a technical support session and for various ways to listen to and watch A Faster PC Live Technical Support.

A Faster PC services the following counties and cities: St. Lucie County including: Port St. Lucie, Fort Pierce, St. Lucie West, Tradition, St. Lucie Village; Martin County including: Stuart, Jensen Beach, Jupiter Island, Ocean Breeze Park, and Sewall's Point; Indian River County: including Vero Beach, Sebastian, Fellsmere, Indian River Shores; Palm Beach County including: Jupiter, Jupiter Inlet Colony, Juno Beach, Tequesta, Palm Beach Gardens, North Palm Beach, Palm Beach Shores, Riviera Beach, West Palm Beach, Wellington, Royal Palm Beach, Greenacres, Lake Worth Beach, Lantana, Boynton Beach, Ocean Ridge, Briny Breezes, Gulf Stream, Delray Beach, Highland Beach, and Boca Raton; Broward County including: Fort Lauderdale, Hollywood, Pompano Beach, Coral Springs, Pembroke Pines, Miramar, Davie, Plantation, Sunrise, Deerfield Beach, Lauderhill, Weston, Tamarac, Coconut Creek, Margate, Lauderdale Lakes, Oakland Park, Hallandale Beach, Cooper City, Wilton Manors, Lighthouse Point, Parkland, Lauderdale-by-the-Sea, Sea Ranch Lakes, Lazy Lake, Hillsboro Beach, Southwest Ranches, North Lauderdale, Dania Beach; Miami-Dade County including: Miami, Miami Beach, Hialeah, Miami Gardens, Coral Gables, Homestead, Doral, North Miami, Aventura, Kendall, Cutler Bay, Sunny Isles Beach, Key Biscayne, Pinecrest, Surfside, Bal Harbour, North Miami Beach, Palmetto Bay, Miami Springs, Opa-locka, Miami Lakes, Florida City, South Miami, Sweetwater, West Miami, Bay Harbor Islands, Biscayne Park, El Portal, Golden Beach, Hialeah Gardens, Indian Creek, Medley, North Bay Village, and Virginia Gardens; and Okeechobee County including: Okeechobee, Taylor Creek, Cypress Quarters, Fort Drum, and Basinger.

Let A Faster PC Handle Your Patch Management

If you would rather not worry about any of this, A Faster PC can handle it for you. As a managed services provider serving businesses and home users across Florida's Treasure Coast, Space Coast, and South Florida, we install Windows, Office, and third-party updates, verify they finished on every computer, and catch the ones that silently fail.

Call A Faster PC at 772-878-5978 or schedule a discovery call to talk about your network. While you are here, download our free cybersecurity report to see where small businesses get caught.

Watch the full video here: The 1,200 Security Flaws In Your Computer You Didn't Know About.