Microsoft Fixes 1,240 CVEs in November Patch Tuesday, Led by Actively Exploited Outlook Flaw

Microsoft's November 2026 Patch Tuesday addresses 1,240 CVEs, 64 of them rated critical. Attackers are already exploiting CVE-2026-124194, a spoofing flaw in Outlook, and a Chromium flaw (CVE-2026-125350) that Microsoft has so far fixed only in Edge for Android. The Readiness team recommends a Patch Now schedule for Windows, Office, Exchange and Microsoft browsers, with SQL Server and developer tools following standard release cycles. The update also resolves October's on-premises Exchange problems, including lost Outlook on the web sign-in and stuck mail in the Outbox.

Why it matters: IT operations teams need to prioritize Outlook, Exchange and browser patches this month because exploitation is already underway, and the October Exchange fixes affect mail reliability.