November Patch Tuesday Puts Outlook First
An Outlook fix belongs at the front of Microsoft’s November rollout. Microsoft says attackers exploited a spoofing flaw before the 10 November updates shipped. For administrators, the first question is which Office builds are running on affected devices. Exchange servers and Windows systems need their own update and verification steps.
BlackTree counted 1,093 distinct vulnerabilities in Microsoft’s 10 November release cohort. Microsoft rates 63 Critical on at least one affected product. The Outlook flaw is the sole entry in that cohort marked as exploited, and none is marked as publicly disclosed in the release data checked on 11 November. Microsoft’s November release data.
Patch the Outlook client first
Microsoft rates CVE-2026-124194 Moderate, with a CVSS score of 6.5. Its advisory describes an attacker persuading someone to open a crafted message file in an affected Outlook client. Outlook can then contact an attacker-controlled location without its usual warning about external content, exposing NTLMv2 authentication material that could be used to impersonate the user. Microsoft says opening the file is required and excludes the Preview Pane as an attack path for this flaw. Microsoft’s release summary and Microsoft’s CVE record.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 10 November and lists 24 November as the due date. Start with the affected Office editions and confirm the running build after the update. Where a suspicious file was already opened, preserve the message and review relevant endpoint, outbound connection and authentication evidence with the incident response team. A patch closes the vulnerability on the updated device. The investigation covers what happened before it was installed. CISA catalogue entry.
| Office deployment | November fix to verify |
|---|---|
| Office LTSC 2021 | 16.0.14334.21048 |
| Office LTSC 2024 | 16.0.17932.21140 |
| Microsoft 365 Apps for Enterprise | Match the installed channel to the 10 November release. Current Channel is Version 2610, Build 20527.20196. |
Microsoft lists separate builds for its enterprise channels. Use the build for the channel assigned to each device and record the exceptions that still need the update. Office security release notes.
Give Exchange and LDAP their own rollout checks
Microsoft rates Exchange Server CVE-2026-118207 Critical. The advisory describes network code execution by an authenticated attacker with low privileges and rates exploitation more likely. Microsoft lists Exchange Server Subscription Edition RTM build 15.02.2562.057 as the fix. Check the Exchange inventory, including hybrid management servers, and verify that the services start after the update. Microsoft says Exchange Online is already protected against the vulnerabilities addressed by these server updates. The team released no November Exchange security update for Exchange 2016 or 2019. Exchange team’s November deployment guidance.
For reachable Windows LDAP services, review CVE-2026-119958. Microsoft rates it Critical at 9.8 and says specially crafted LDAP requests can lead to code execution without authentication. Microsoft had recorded no exploitation for either this flaw or the Exchange example at the time of the check. Use network reachability and the role of the server to order the rollout, and test directory-dependent sign-in and application queries in the first ring. Microsoft’s product and remediation data.
Match the Windows package to the branch
These are the standard November cumulative updates for the listed branches. Check the edition, servicing entitlement and deployment channel on each device. Use the separate guidance for systems enrolled in Hotpatch.
| Windows branch | November KB | OS build to verify |
|---|---|---|
| Windows 11 26H2 | KB5132061 | 26300.9974 |
| Windows 11 25H2 | KB5132061 | 26200.9974 |
| Windows 11 24H2, supported editions | KB5132061 | 26100.9974 |
| Windows 11 26H1 | KB5132059 | 28000.3501 |
| Windows 11 23H2 Enterprise and Education | KB5131087 | 22631.7711 |
| Windows 10 22H2 with ESU / 21H2 LTSC | KB5131096 | 19045.7846 / 19044.7846 |
| Windows Server 2025 | KB5131080 | 26100.33822 |
| Windows Server 2022 | KB5131090 | 20348.5870 |
| Windows Server 2019 / Windows 10 Enterprise LTSC 2019 | KB5131085 | 17763.9487 |
| Windows Server 2016 | KB5131291 | 14393.9688 |
For standalone installation of KB5132061, read Microsoft’s checkpoint update and prerequisite instructions for the device architecture. Windows Server 2022 Datacenter Azure Edition devices on the Hotpatch schedule receive a baseline this month, so plan for a restart. Microsoft’s November release summary.
Test the services the updates can affect
The Exchange team says the November Windows Server updates address the instability reported after October’s updates, including Outlook on the web sign-in failures, stuck mail and mailbox replication problems. The Exchange security update addresses Exchange vulnerabilities separately. For the first patched server, test a real sign-in, send and receive mail, inspect transport queues and check database replication where applicable. Microsoft says the October registry workaround is no longer required once the November Windows Server update is installed. Exchange team’s issue update.
Include signed PowerShell jobs in the server pilot. Microsoft’s Server 2022 notes describe stricter encoding checks that can reject scripts whose signatures previously validated. If a representative job fails, check the file encoding and have its owner re-sign the corrected script through the existing signing process. Server 2022 update notes.
Move the remaining Windows 11 23H2 devices
The November update is the last monthly release for Windows 11 23H2 Enterprise and Education. Apply it to the remaining devices and assign a migration owner and date for each one. Confirm the edition and target release before scheduling the move. Microsoft’s 23H2 servicing notice.
How the release was counted
The count uses unique CVE identifiers whose earliest revision in the November CVRF document matches Microsoft’s initial release timestamp on 10 November. Earlier entries and later additions fall outside that cohort. Critical counts use Microsoft’s product severity labels. Exploitation and disclosure use Microsoft’s flags in the snapshot revised at 01:07 UTC on 11 November. Release metadata and November CVRF document.
For the wider release record, see BlackTree Lifecycle’s November Microsoft entry. October’s BlackTree Patch Tuesday coverage records the previous month’s rollout issues.
