74 openlast updated

HomeNovember 2026 patch cycleCVE-2026-124194, KB5132061: Patch Tuesday roundup

Patch nowEnterpriseEnd-user apps

CVE-2026-124194, KB5132061: Patch Tuesday roundup

Part of November 2026 patch cycle

Vendor
Microsoft
Products
Windows 10, Windows 11, Windows Server 2016-2025, Microsoft 365 Apps, Office LTSC 2021/2024, Exchange Server SE, and SharePoint Server SE
Published
Status
Open

Known issues

Highlight all 2 on the home board

Call: Patch now. One exploited bug this month, and it’s in Outlook, not Windows: CVE-2026-124194, which leaks NTLMv2 hashes when someone opens a crafted file. CISA’s due date is November 24. That means the Office update matters as much as the Windows one. Check your Click-to-Run builds, not just your Windows compliance. The Windows updates are mostly good news: they fix four of last month’s known issues, including the Exchange one.

Update, Nov 11: Microsoft confirmed a new known issue on Wednesday afternoon. Since October’s updates, SQL Server linked server connections over OLE DB can stay open and pile up, and November doesn’t fix it. An out-of-band fix is promised “in the next few days.” Microsoft also lists slmgr activation commands failing with 0x80041008 on November’s Server updates. Details are under What breaks.

The numbers

About 1,094 CVEs (SecurityWeek). Born counts 1,093 with 63 critical, and Microsoft’s own API lists 1,095 Microsoft-assigned CVEs with 64 critical, plus Chromium and other third-party entries. BleepingComputer gets 1,235 and 66 critical by counting 142 Edge/Chromium entries. It’s the second month in a row over 1,000. The Register has it as “over 1,000 bugs but only one zero-day so far.”

  • Exploited: CVE-2026-124194 (Outlook spoofing / NTLMv2 hash leak). Rated Moderate, 6.5. Patch it anyway.
  • Publicly disclosed: none.
  • Worth a look: CVE-2026-118146 (AD Domain Services RCE, 8.8, authenticated), CVE-2026-119952 (Schannel RCE, 8.1, unauthenticated), CVE-2026-118207 (Exchange SE RCE, 8.8, KB5133453) and CVE-2026-120002 (SharePoint SE elevation of privilege, 9.9, KB5002945). Microsoft rates the first three “Exploitation More Likely.”
  • KBs: KB5132061 (Win11 24H2/25H2/26H2), KB5132059 (Win11 26H1), KB5131087 (Win11 23H2), KB5131096 (Win10 21H2/22H2 ESU), KB5131080 (WS2025), KB5131090 (WS2022), KB5131085 (WS2019), KB5131291 (WS2016).

What breaks

KB5132061 fails to install (Known issue, reported, not confirmed). Neowin says “many” readers hit 0x800f0993, others 0x800f0989. Windows Latest adds 0x80070306. Microsoft still says it’s “not currently aware of any issues.” DISM /RestoreHealth plus sfc /scannow, or the standalone .msu, got some people through. One user traced their failure to Windows Sandbox: disabling it, restarting and reinstalling worked (Neowin). On November 11 Windows Latest said it had been told Microsoft is investigating. That’s not an official known issue yet, and some failures happen with Sandbox off. Watch for machines silently stuck on October. (Neowin, Windows Latest)

SQL Server linked server connections stay open (Known issue, confirmed). Opened by Microsoft on November 11. After the October 13 updates and anything later, “connections created by SQL Server linked server queries might remain open after the queries complete.” They accumulate and “can slow or degrade server performance after prolonged run time.” It hits OLE DB providers, and Oracle and PostgreSQL are named. It’s listed on Server 2012 through 2025 and on several client versions. Microsoft Support for business has a mitigation. Restarting the SQL service clears it for a while. The out-of-band fix is due “in the next few days.” (Server 2022 release health)

NTLM signing by default trips up App Volumes (reported, not confirmed). November’s updates make Windows clients offer NTLM signing by default (KB5135557, CVE-2026-118737). Three admins in an Omnissa community thread say the App Volumes agent then can’t sign in to its Manager and disables virtualization. Microsoft’s temporary switch, ClientAllowUnsignedNtlm=1 under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0, got them working again. Use it on the affected images only, because it turns the new protection off. Servers start requiring signing in May 2027.

Signed PowerShell scripts (heads-up, by design). KB5132061 tightens script signature checks. Microsoft: “scripts containing invalid UTF-8 encoding might fail signature validation, even if they were previously accepted.” The fix is to re-save as UTF-8 with BOM and re-sign. No breakage reports yet. If you run AllSigned, test your login and deployment scripts on a pilot box before this reaches everything. (KB5132061)

slmgr activation commands fail on Server (Known issue, confirmed in part). Microsoft now lists a known issue on the November Server KBs (KB5131090, KB5131085, KB5131080): activation and licensing operations through slmgr “might fail” with error 0x80041008. It names /skms-domain and /ipk. Machines that are already activated stay activated. A workaround is available from Microsoft Support for business, and a fix is due “in the coming days.” Separately, eight people in the r/sysadmin megathread say slmgr /rearm fails during Citrix MCS image prep on Server 2019, 2022 and 2025 masters. Microsoft’s note doesn’t mention /rearm, so that part is still unconfirmed. Patch MCS masters last and test a prep first. (KB5131090, megathread)

Thin reports, not confirmed. From the r/sysadmin megathread, nothing confirmed by Microsoft:

  • DNS debug logging to a custom path stops, and the path reverts to the default dns.log. Now two reports: KB5131085 on Server 2019 (uninstalling restored it) and Server 2022 (setting the custom path again fixed it)
  • Win11 26H2 not being offered the update (the poster asked whether it was pulled; Microsoft’s 26H2 release health page lists KB5132061 normally, and we’ve seen nothing saying it was paused)
  • .NET updates missing from the online check on Server 2019/2022
  • No patches offered after 11 AM at a Canadian no-DST site
  • Duplicate MSRT x64 entries in WSUS

One person each reported the rest. We’ll watch these. (megathread)

What November fixes

  • On-prem Exchange and the October EPM limit: resolved on Server 2016, 2019, 2022 and 2025. You don’t need the EpmapSavedContextCap workaround once November is on.
  • Non-admin RDP and 0xC000000D with Administrator protection: now resolved on 24H2 too.
  • USB Audio Class 1.0 Code 10: resolved.
  • “Add device” printers failing with error 87: fixed on Win11 24H2 and later, and in Win10 ESU KB5131096.
  • Always On VPN and Smart App Control: the October preview fixes now ship in the security update.
  • Exchange Server SE SU (KB5133453): fixes CVE-2026-118207. The Exchange team lists no known issues, and the order of the Exchange and Windows updates doesn’t matter. Exchange 2016 and 2019 got nothing: they’re out of support and no longer even tested. (Exchange team blog)

Not Microsoft, but this week

  • Chrome CVE-2026-125350: exploited, fixed in 157.0.8103.50/.51. Edge for Android got the fix on November 11 (157.0.4341.53). Desktop Edge still hadn’t, per Microsoft’s release notes, as of Wednesday evening.
  • Barracuda ESG: CVE-2026-116606 plus CVE-2026-111560, a root chain that is exploited. KEV due Nov 13.
  • Fortinet: 89 advisories for the October hardening builds, 19 critical. FortiManager and FortiAnalyzer 8.0.2 are still exposed to FG-IR-26-219 if the JSON API is on.
  • KEV, Nov 9-10: Cisco BroadWorks, Openwave Webtop Media Transcoder, FreeSWITCH, GPUStack and IBM Aspera Faspex. Three of them are due Nov 12.
  • Xen Orchestra VSA-2026-062: an auth bypass that is being exploited, from one crafted cookie to root on XCP-ng. Fixed in XO 6.9.2 (stable) and 6.10.1 (latest). A second flaw from the same campaign, VSA-2026-063 (crafted VM imports), has no fix yet. Limit VM imports to Admin users.
  • N-able N-central 2026.4 HF2: N-able calls it a critical security update: seven CVEs, released Nov 10. Huntress and CSO Online tie it to 33 “Able2Shell” exploits published Nov 8. Upgrade the server, then Agents first and Probes second. Built-in remote control is off in HF2; Take Control still works.
  • Citrix: NetScaler’s first scheduled security bulletin lands Thu Nov 12, 12:00 UTC (5 AM MT). Book a maintenance window now. (Citrix)

Housekeeping

  • AskWoody is at MS-DEFCON 2 (pause updates) as of November 5. Its master patch list is for Plus members only, so we can’t tell you what it says.
  • Microsoft added CVE-2026-126526 (OneNote RCE) on November 11. Its note says the fix shipped in the November updates and the CVE was “inadvertently omitted.” If November is installed, there’s nothing to do.
  • Hotpatch devices get separate PowerShell security updates after the November hotpatch: KB5135385 (Win11 24H2/25H2/26H2) and KB5135386 (Server 2025).
  • There’s no December non-security preview update this year. Microsoft says normal previews resume in January.
  • Windows 11 24H2 Home and Pro no longer get updates. KB5132061 on 24H2 is Enterprise and Education only.
  • Cuba’s DST change is in this update.

Full tracker: Patch Watch.

Sources

More from November 2026 patch cycle