Microsoft released its November 2026 security updates on 10 November. One of the flaws fixed, in Outlook, is already being used by attackers, and a long list of critical fixes covers Outlook, Word, Excel and the Windows servers many offices still run. Here is what matters for businesses in Hong Kong and Singapore, and what to update first.
The short version
- Update Microsoft 365 Apps and Office, with Outlook first. An Outlook flaw is being exploited, and several critical Outlook and Office flaws can be triggered just by previewing an email or file.
- Install this month's Windows updates and restart, on PCs, laptops and servers.
- If you run your own servers, prioritise domain controllers and any on-premises Exchange Server.
How big is this month's release?
Microsoft's release notes put the November release at 1,094 vulnerabilities in its own products. Most are rated Important; Microsoft rates 64 of the month's flaws Critical, although three of those are in cloud services (Entra Device Registration, Azure OpenAI and Azure Managed Grafana) that Microsoft has already fixed, with nothing for customers to do. The update listing also republishes fixes for third-party components, such as Chrome and Linux, which is why some reports quote a higher total.
Actively exploited: Outlook (CVE-2026-124194)
This is the flaw to act on first. Microsoft describes it as a spoofing flaw: an attacker sends a specially crafted file and persuades someone to open it in Outlook. Opening it can make Outlook connect to a server the attacker controls without showing the usual warning about external content. That connection can hand over a coded form of the user's Windows sign-in (an NTLMv2 hash), which an attacker could use to pose as that person.
Microsoft rates the flaw Moderate: the user has to open the file, and the Preview Pane is not an attack vector. But Microsoft marks it as exploited, and the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue on 10 November, giving US federal agencies until 24 November to fix it. Phishing emails exist to get people to open files, so treat it as urgent.
Microsoft lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 as affected; the fix arrives through the normal Office update.
Also critical this month
Outlook, Word and Excel: risks from previewing
Microsoft rates three Outlook flaws (CVE-2026-110043, CVE-2026-110068 and CVE-2026-111309) as Critical. For each, Microsoft says the Preview Pane is an attack vector: viewing a specially crafted email could be enough, without opening it or clicking anything. Several critical Word and Office fixes carry the same note, and there are more than ten critical Excel fixes for malicious files a user would have to open. Updating Office removes the risk.
Windows Search and Exchange: attachments that need no click
Microsoft rates a Windows Search flaw (CVE-2026-116928) as Critical. In Microsoft's description, the attack targets the search component used by Exchange Server: an email with a specially crafted attachment is indexed automatically, so nobody has to open the email or the attachment. The fix is in this month's Windows update for the server.
Microsoft also rates an Exchange Server flaw (CVE-2026-118207) as Critical. It needs an attacker with a low-level account on the server, but Microsoft rates exploitation as more likely. The fix is published for Exchange Server Subscription Edition. Exchange Online is run by Microsoft, so these two fixes are for organisations that host Exchange themselves.
Domain controllers and other servers
If you run Windows servers in the office or in a data centre, note the critical fixes for Windows LDAP (CVE-2026-119958), which Microsoft says can be triggered over the network without signing in, and for Active Directory Domain Services (CVE-2026-118146). Both are services that domain controllers, the servers that handle staff sign-ins, rely on. Other critical server fixes cover Message Queuing, Remote Procedure Call, Internet Information Services and Hyper-V.
What to update first
- Microsoft 365 Apps or Office, with Outlook as the priority, for the exploited flaw and the Preview Pane flaws.
- Windows on every PC and laptop, then restart.
- Domain controllers and other Windows servers, for the LDAP and Active Directory fixes.
- Exchange Server, if you run your own: both the Windows update on the server and the Exchange update.
- SQL Server and SharePoint Server, if you host them yourself.
Restart devices after updating. Many Windows and Office updates only take effect after a restart, and laptops that are put to sleep rather than shut down can go weeks without one.
For Microsoft 365 and Intune admins
- In the Intune admin centre, check that your Windows update rings deliver this month's quality update without a long deferral, and use the update reports to find devices that have not installed it. Set a deadline so devices restart automatically.
- Check which Microsoft 365 Apps update channel your devices use. Devices on a slower channel receive Office fixes later, so the exploited Outlook flaw may stay open longer on them.
- Windows 10 devices only receive these fixes if they are enrolled in Microsoft's paid Extended Security Updates programme. Our guide to when to replace business laptops and desktops covers what to do with older devices.
Frequently asked questions
Our updates install automatically. Do we need to do anything?
Check that they actually installed and that devices have restarted. Devices that are rarely restarted can stay unprotected for weeks.
What is an NTLM hash, and why does it matter?
It is a scrambled form of a user's Windows sign-in that Windows sends to prove who you are on a network. If an attacker captures it, they may be able to use it to sign in to other systems as that user, without ever knowing the password. This month's exploited Outlook flaw can leak it.
Do we need to update anything for Microsoft 365 in the cloud?
No. Microsoft has already fixed this month's cloud flaws. You need to update the apps on your devices, Windows itself and any servers you run yourself.
Sources and further reading
- Microsoft Security Update Guide: November 2026 release notes
- Microsoft Security Update Guide: CVE-2026-124194
- CISA: Known Exploited Vulnerabilities catalogue
- HKCERT: Microsoft Monthly Security Update (November 2026)
- CSA Singapore: November 2026 Monthly Patch
If you are not sure whether your devices and servers have this month's updates, our managed IT services team keeps Windows, Microsoft 365 Apps and servers patched for you, and our Microsoft 365 team can check your update policies. Talk to our team.
