November 2026 Patch Tuesday: Outlook zero-day and .NET 8 and 9 end

Microsoft released its November security updates on Tuesday 10 November 2026. We previewed the release before it landed; this is what actually shipped.

The numbers

Microsoft’s release notes say the release “consists of 1094 Microsoft CVEs”. Windows accounts for two thirds of them:

Microsoft marks one of them as exploited, and none as publicly disclosed before the fix.

The zero-day: Outlook CVE-2026-124194

The only bug Microsoft lists as “Exploitation Detected” is CVE-2026-124194, a spoofing vulnerability in Outlook. Microsoft explains the attack like this: an attacker sends “a specially crafted message file” and convinces the user to open it. Outlook then connects to a network location the attacker controls “without displaying the usual external-content warning”, and that connection hands over the user’s NTLMv2 hash, which the attacker can use to authenticate as that user.

A few details matter for prioritising:

• The preview pane is not an attack vector. The user has to open the file.
• Microsoft rates it Moderate with a CVSS score of 6.5. Don’t let that slow you down: it’s the one that’s being used.
• CISA added it to its Known Exploited Vulnerabilities catalog on 10 November and gave US federal agencies until 24 November.

Affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. The CVE record lists the fixed builds as 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for LTSC 2024. For Microsoft 365 Apps, Microsoft points to its Office security release notes for the fixed build on each update channel.

Critical bugs on the server side

Nothing else is known to be exploited, but several fixes cover services that face the network:

• Windows LDAP, CVE-2026-119958 (CVSS 9.8). An unauthenticated attacker could run code “through a specially crafted set of LDAP calls”. Prioritise domain controllers.
• Windows Search, CVE-2026-116928 (CVSS 9.8). An attacker sends an email with a crafted attachment, and Exchange “automatically processes the attachment for indexing, so the recipient does not need to open the email or attachment”.
• IIS, CVE-2026-119961 (CVSS 8.1). An unauthenticated attacker could run code with a crafted packet, but has to win a race condition.
• Schannel, CVE-2026-119952 (CVSS 8.1). Unauthenticated code execution through Windows’ TLS stack. It needs specific protocol settings, but Microsoft rates it “Exploitation More Likely”.
• Exchange Server, CVE-2026-118207 (CVSS 8.8). An authenticated attacker with low-level access could run code on the server. Also “Exploitation More Likely”. The affected product listed is Exchange Server Subscription Edition (update KB5133453).
• Active Directory Domain Services, CVE-2026-118146 (CVSS 8.8). Code execution for an authenticated attacker, again “More Likely”.

SharePoint gets 27 fixes, including CVE-2026-120002 (CVSS 9.9), an elevation of privilege that could make SharePoint act on a connected business service using shared credentials. SQL Server gets 59, the highest being CVE-2026-116945 (CVSS 9.8), where an attacker who controls an endpoint an integration package connects to could run code. Microsoft rates both Important.

For web developers: ASP.NET Core, and goodbye .NET 8 and 9

On 10 November Microsoft shipped .NET 10.0.15, 9.0.23 and 8.0.34, plus the first release of .NET 11 (11.0.0), along with 13 ASP.NET Core security advisories. The most serious, CVE-2026-114146 (CVSS 9.0, Critical), affects SignalR: connections “are not consistently bound to the identity negotiated at connection establishment, allowing injected messages to execute Hub invocations as the victim”.

The bigger news is the calendar. Microsoft’s release notes say .NET 8 reached end of support on 10 November 2026, and .NET 9 was supported until the same date. From now on they won’t get security fixes. The supported versions are .NET 10 (LTS) and .NET 11, both supported until 14 November 2028.

dotnet --list-runtimes
dotnet --list-sdks

If those show 8.0 or 9.0 runtimes on a server or in a container image, install 8.0.34 or 9.0.23 now and plan the move to .NET 10.

Updates to install on Windows Server

Microsoft lists known issues for all four of these updates, for SQL Server 2025 CU10 and SQL Server 2022 CU27, and for the .NET 8 and 9 updates. Read them before you roll out. Two changes in the Windows Server 2025 notes are worth testing first: clients now offer NTLM message signing by default, and PowerShell scripts with invalid UTF-8 “might fail signature validation, even if they were previously accepted”.

A suggested order

1. Office and Outlook on every desktop, for the exploited CVE-2026-124194.
2. Domain controllers and Exchange: LDAP, Active Directory, Windows Search and Exchange fixes.
3. Internet-facing IIS servers and apps: Windows cumulative updates plus .NET and ASP.NET Core runtimes.
4. SharePoint and SQL Server, then everything else in your normal cycle.

Not every urgent fix came from Microsoft. Two other recent additions to CISA’s exploited list affect common web stacks: the WordPress core upgrade flaw and the GitLab CI/CD regex flaw.

Sources

• Microsoft Security Update Guide: November 2026 release notes (opens in a new tab)
• Microsoft Security Update Guide: CVE-2026-124194 (opens in a new tab)
• CVE record: CVE-2026-124194 (opens in a new tab)
• CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (10 November 2026) (opens in a new tab)
• Microsoft Support: KB5131080, Windows Server 2025 (10 November 2026) (opens in a new tab)
• .NET 8.0 release notes (opens in a new tab)
• .NET 9.0 release notes (opens in a new tab)
• .NET announcements: November 2026 ASP.NET Core security updates (opens in a new tab)
• ASP.NET Core advisory: CVE-2026-114146 (opens in a new tab)