Microsoft’s November 2026 Patch Tuesday, released on November 10, is enormous: more than 1,000 vulnerabilities fixed across Windows, Office, Azure and server products. One of them was already being used in attacks before the fix arrived, and it sits in a program almost every office uses every day: Outlook.
What happened
The exploited flaw, CVE-2026-124194, is an Outlook spoofing vulnerability with a medium severity score of 6.5. Microsoft’s own description says the product’s interface does not warn the user about unsafe actions. CISA added it to its Known Exploited Vulnerabilities catalog on November 10 and gave federal agencies until November 24 to apply the fix. Microsoft also flagged 42 other bugs in this release as more likely to be exploited.
Why it matters to small businesses
Email is where most attacks begin, so a flaw that attackers are already using in Outlook deserves the front of your to-do list. The same release also fixes several critical, no-login-required flaws rated 9.8 out of 10 in core Windows network services: Kerberos, LDAP, DNS, DHCP Server and iSCSI. If your office runs its own Windows servers, those are the ones to get to next. SharePoint Server, Azure DevOps Server and SQL Server also received critical fixes.
What to do now
- Install the November updates for Microsoft 365 Apps and Windows on every PC, and restart so the updates take effect.
- Patch servers next, starting with domain controllers and any DNS or DHCP servers, then SQL Server and SharePoint.
- Check that Windows Update or your patch tool is actually reporting success, rather than assuming it is working.
- Remind staff to pause before acting on unexpected emails, prompts or attachments, even in a familiar program.
- Ask whoever manages your IT how quickly critical patches are normally applied, and get the answer in writing.
Not sure whether your computers and servers have these updates? Call Arete Technology Systems at (317) 585-6100 and we can help you find out.