Install November Microsoft updates now: Outlook flaw under active attack
Microsoft's November 2026 updates fix an Outlook flaw already used in attacks. Here is what small businesses should check this week.
Published by oowl. General information for Australian small businesses, not advice for any particular organisation.
What happened
On 10 November 2026 Microsoft released its monthly security updates. Among the fixes is a flaw in Outlook, tracked as CVE-2026-124194, which The Register reports Microsoft has marked as exploited, meaning it has been used in real attacks. The same day, CISA added it to its Known Exploited Vulnerabilities catalog.
The flaw is a spoofing issue. A crafted message file can make Outlook connect to a network location chosen by the attacker without the usual external-content warning. That leaks the user's NTLMv2 hash, which can be used to authenticate as that user. The attacker needs the user to open the file, so the lure is an ordinary-looking message.
The same release fixes more than a thousand other bugs. The Register also lists three remote code execution flaws rated 9.8 out of 10. One sits in the Windows Search component, where an email with a crafted attachment can be processed by Exchange for indexing without the recipient opening it. Another is in the Windows LDAP implementation, which could affect domain controllers. Read the Register's Patch Tuesday summary for the full picture.
Who is affected
Most small businesses that use Windows, Outlook, Microsoft 365 or Exchange are in scope. The Outlook flaw sits in the mail client itself, so it reaches staff who simply read email. The Exchange and domain controller flaws matter most for businesses that run their own mail server or a Windows domain.
Some Windows 11 devices may not finish the update. Microsoft said devices that installed the October 2026 preview update can stall with errors 0x80070306, 0x800f0989 or 0x800f0993. According to BleepingComputer, Microsoft said these devices should repair automatically within 24 to 48 hours from 11 November. A stalled device is still unpatched, so check it rather than assume it is covered.
What to do
- Ask your IT provider, or check yourself, that the November 2026 security updates are installed on every Windows PC and server.
- Check that Outlook is updated, not only Windows. The Outlook flaw is the one attackers are using now.
- Patch Exchange servers and domain controllers first, then the rest of the fleet.
- If a machine is still stuck on the update 48 hours after 11 November, record the error code and contact Microsoft Support.
- Tell staff not to open message files, attachments or links they were not expecting, even if they appear to come from a colleague. Ask them to report anything odd to your IT provider.
- If a user has opened a suspicious file, ask your IT provider to review sign-in logs for that account and reset the password. Report the incident to ReportCyber at cyber.gov.au.
- If you have no written patching routine, see our Essential Eight page for how patching and multi-factor authentication fit together.
Sources
- Known Exploited Vulnerabilities catalog (CVE-2026-124194 entry), CISA
- November 2026 Patch Tuesday fixes over 1,000 bugs, one already exploited, The Register
- Microsoft confirms Windows 11 November 2026 security update installation issues, BleepingComputer
oowl writes each brief in its own words from the public sources listed. Check the sources for the latest detail, because advisories are often updated after publication. More briefs: all threat briefs or the Atom feed.
Not sure where your business stands?
The free security check is a passive look at what your business already exposes to the internet, read from public records only, with a one-page result in plain English.