For November, Patch Tuesday means a to-do list that starts with Outlook – Computerworld

November is a (relatively) big month. Microsoft’s November 2026 Patch Tuesday fixes 1,240 CVEs, 64 of them rated critical. Start with Outlook: attackers are already using CVE-2026-124194, a spoofing flaw. A Chromium flaw, CVE-2026-125350, is also being exploited, and at the time of writing, Microsoft has fixed it only in Edge for Android. The Readiness team recommends that Windows, Office, Exchange and Microsoft browsers are included in a Patch Now schedule. SQL Server and Microsoft developer tools can follow your standard release schedule. Our infographic shows the deployment risk for each product family. Our count takes Microsoft’s 1,094 CVEs, adds 165 republished Chromium fixes and leaves out 19 Azure and open-source entries.

Known issues

Good news first: the November Windows 11 updates list no known issues. The three updates are KB5132061, KB5132059 and KB5131087. Several older issues also close this month:

• On-premises Exchange had a rough October. After the October Windows Server updates, some servers lost Outlook on the web sign-in, left mail in the Outbox or failed mailbox replication. The November server updates fix this: KB5131080 for Windows Server 2025 and KB5131090 for Windows Server 2022. Windows Server 2019 gets KB5131085, and Windows Server 2016 gets KB5131291.
• Some USB Audio Class 1.0 devices that have failed with error code 10 since 8 September should start again.
• Adding a printer published in Active Directory through Settings works again, after failing with error 87 since October.
• KB5132061 fixes two October issues on Windows 11 24H2. Smart App Control can be turned back on, and non-admin Remote Desktop works again with Administrator protection enabled. 25H2 and 26H2 already had both fixes from the 28 October preview. That preview was KB5127936.

One Windows Server issue stays open. WSUS still hides synchronization error details on Windows Server 2025 and 2022. Microsoft made that change to address CVE-2025-59287, and there is no published workaround. If a sync fails, WSUS will not tell you why.