Microsoft's November 2026 Patch Tuesday was released on 10 November and fixed more than 1,000 vulnerabilities. One of them is an Outlook flaw that attackers were already using before the fix existed. Someone opens a booby-trapped file and Outlook quietly hands over a scrambled copy of their Windows login, which the attacker can then try to crack. For a Perth business, the job this week is to get the November updates installed and restarted on every PC. Make sure Microsoft Office is updating too, and if you run your own Exchange, SharePoint or Windows servers, patch those as a priority.
What landed this month
The headline number depends on who's counting. Tenable puts it at 1,093 CVEs across 287 Microsoft products and components. BleepingComputer counts 1,235, with 66 rated Critical. Either way it's the second month running with a four-figure total, after October's record 1,411.
Most of these are bugs that let an attacker who already has a foothold go further, or run their own code on a machine. You don't need to read the advisories one by one. What matters is how long it takes between Microsoft publishing a fix and every computer in your office having it installed. Attackers study each month's fixes and start targeting the businesses that are slow to update.
The Outlook zero-day: CVE-2026-124194
This is the one being exploited right now. Microsoft lists it as an Outlook spoofing vulnerability with a CVSS score of 6.5 and a "Moderate" rating. Don't let the low rating fool you. Microsoft confirms attackers were using it before the patch was released, and the US cybersecurity agency CISA added it to its Known Exploited Vulnerabilities list the same day.
How the attack works
According to reports on Microsoft's advisory:
- The attacker sends a specially crafted file, which in practice usually arrives as an email attachment.
- If the user opens it, Outlook connects to a network location the attacker controls, and it does so without the usual warning about external content.
- During that connection Windows sends the user's NTLMv2 hash, a scrambled version of their login credentials.
- The attacker takes the hash away and tries to crack it offline, or uses it to impersonate that person on other systems.
Security firm Outpost24 notes that the Preview Pane isn't an attack vector. Someone has to actually open the file. That's useful, but it's no comfort in an office where opening attachments is a normal part of the day.
Why this matters for a small business
A cracked hash gives the attacker the user's real password. In many small offices that same password opens the PC, the file server, the VPN and, through account sync, Microsoft 365. One opened attachment can become a login to everything. That's the same chain we see in business email compromise incidents, and it usually ends with fake invoices sent from a real mailbox.
The other fixes worth prioritising
Apart from the zero-day, a few Critical fixes matter more to small businesses than the rest:
- Exchange Server (CVE-2026-118207): a remote code execution flaw rated 8.8 that Microsoft considers "exploitation more likely". If you still run Exchange on-premises, patch it this week.
- SharePoint Server (CVE-2026-120002): an elevation-of-privilege flaw scored 9.9 out of 10. It only affects SharePoint you host yourself, not SharePoint Online.
- Active Directory Domain Services (CVE-2026-118146): a remote code execution flaw on domain controllers, the servers that hold every staff login.
- Windows Schannel (CVE-2026-119952): a remote code execution flaw that an attacker can attempt without logging in first.
- Microsoft Office and Excel: several Critical remote code execution flaws, the kind delivered through a malicious document. Office needs to update just like Windows does.
If those servers sound like your office, read our guide to on-premises server management. Servers tend to fall behind on patching because nobody wants to reboot them during business hours.
What to do this week
1. Install and restart
Windows Update downloads patches in the background, but many of them only take effect after a restart. A laptop that has been put to sleep every night for a fortnight is still unpatched. Check that every PC and server shows the November 2026 cumulative update as installed.
2. Check that Office is updating
The Outlook fix ships with Microsoft 365 Apps or your Office install, not with Windows. Open Outlook, go to File → Office Account → Update Options and make sure updates are turned on. Older perpetual versions such as Office 2016 and 2019 are already out of support and won't get fixes for flaws like this.
3. Block outbound SMB at the firewall
This type of attack depends on your PCs connecting out to an attacker's server, usually over SMB (TCP port 445). A normal office has almost no reason to make SMB connections to the open internet. Blocking that traffic at the business firewall cuts off this whole family of hash-leaking bugs, including the next one.
4. Make stolen passwords less useful
- Use long passphrases. A weak password falls to offline cracking in minutes, while a long passphrase can resist it for years.
- Turn on multi-factor authentication for Microsoft 365, remote access and anything internet-facing. A cracked password on its own then won't get the attacker in.
- Put admin accounts in Windows' Protected Users group, which stops them using NTLM at all.
5. Check what lost support this week
10 November was also the end of support for Windows 11 Enterprise and Education 23H2 and for .NET 8. Any PC on an unsupported version won't receive this month's fixes. Our 10 November end-of-support guide explains what to check.
The bigger picture
This is the third month in a row with an exploited zero-day, after August, September and October. That's normal now. Patching isn't a quarterly clean-up job any more. It has to happen within days, every month, and someone has to confirm it actually did.
If nobody in your office is clearly responsible for that, a managed IT services provider can take it on. The provider installs the updates, confirms the restarts, keeps Office and your servers current, and tells you when something urgent like this Outlook flaw lands.
IT Support Perth is the managed IT division of Computer Mechanics, looking after Perth businesses since 1997. If you're not sure whether your PCs and servers have the November fixes, call us on (08) 9325 1196 and we'll check for you.