The monthly Windows Update, which delivers Windows security updates and bug fixes, has been released. This Windows Update addresses multiple vulnerabilities, including a vulnerability in Outlook.
Security updates for November 2026 (monthly)
https://www.microsoft.com/en-us/msrc/blog/2026/11/202611-security-update
Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day/
Microsoft releases Windows 10 KB5131096 extended security update
https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5131096-extended-security-update/
Windows 11 KB5132061 & KB5131087 cumulative updates released
https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5132061-and-kb5131087-cumulative-updates-released/
This time, KB5132059 for Windows 11 26H1, KB5132061 for Windows 11 26H2/25H2/24H2, KB5131087 for Windows 11 23H2, and KB5131096 for Windows 10 22H2 have been released. Note that updates for 23H2 Enterprise and Education will end with this release.
The list of security updates for November 2026 is as follows.
| Affected products | Maximum severity | Greatest impact | Related support technical information or support webpage |
|---|---|---|---|
| Windows 11 v26H2, v25H2, v24H2, v23H2 | Critical | Remote code execution | v26H1 5132059 v26H2, v25H2, v24H2 5132061 v26H2, v25H2, v24H2 Hotpatch 5132043 v23H2 5131087 |
| Windows Server 2025 (including Server Core installation) | Critical | Remote code execution | 5131080 HotPatch 5131077 |
| Windows Server 2022, (including Server Core installation) | Critical | Remote code execution | 5131090 |
| Windows Server 2019, 2016 (including Server Core installation) | Critical | Remote code execution | Windows Server 2019,5131085 Windows Server 2016,5131291 |
| Microsoft Office | Critical | Remote code execution | https://learn.microsoft.com/officeupdates |
| Microsoft SharePoint | Important | Remote code execution | https://learn.microsoft.com/officeupdates/sharepoint-updates |
| Microsoft Exchange | Critical | Remote code execution | https://learn.microsoft.com/exchange Released: November 2026 Exchange Server Security Updates |
| Microsoft SQL Server | Important | Remote code execution | https://learn.microsoft.com/SQL |
| Microsoft Dynamics 365 | Important | Elevation of privilege | https://learn.microsoft.com/dynamics365 |
| Microsoft Azure | Critical | Remote code execution | https://learn.microsoft.com/azure |
| Microsoft .NET | Important | Remote code execution | https://learn.microsoft.com/dotnet |
| Microsoft Visual Studio | Important | Remote code execution | https://learn.microsoft.com/visualstudio |
The approximate number of bugs in each category is as follows.
・Privilege escalation vulnerabilities: 536
・Security feature bypass vulnerabilities: 27
・Remote code execution vulnerabilities: 296
・Information disclosure vulnerabilities: 157
・Denial of service vulnerabilities: 46
・Spoofing vulnerabilities: 22
・Microsoft Edge (Chromium-based) vulnerabilities: 142
The spoofing vulnerability CVE-2026-124194 in Microsoft Outlook has been fixed. When a specially crafted message file is opened in Microsoft Outlook, the warning about external content that would normally be displayed is not shown, potentially resulting in a connection to a network controlled by an attacker. This may disclose credentials that could be used to impersonate the user.
Windows updates are released on the second Tuesday of each month, U.S. time, and the next scheduled update date is December 9, 2026 (Wednesday), Japan time.
