November 2026 Patch Tuesday: Outlook Zero-Day and 1,000+ Fixes

The Outlook zero-day is the headline, but the real challenge this month is volume. IT teams face more than 1,000 fixes, 63 of them rated Critical. Elevation of privilege accounts for about 49% of the flaws and remote code execution for about 27%. By product, Windows accounts for 733 fixes, Office for 174, SQL Server for 52, SharePoint Server for 27 and Exchange Server for 9.

Several non-exploited flaws deserve as much attention as the zero-day, because they hit the servers an enterprise depends on:

• CVE-2026-119958 (CVSS 9.8): remote code execution in Windows LDAP, unauthenticated and with no user interaction.
• CVE-2026-116928 (CVSS 9.8): remote code execution in Windows Search that can be reached through an email whose malicious attachment is automatically indexed. The fix is in the Windows cumulative update, not the Exchange update.
• CVE-2026-118207 (CVSS 8.8): authenticated remote code execution in Exchange Server.
• CVE-2026-118146 (CVSS 8.8): authenticated remote code execution in Active Directory Domain Services.
• CVE-2026-119952 (CVSS 8.1): remote code execution in Schannel, which Microsoft rates "Exploitation More Likely."
• Message Queuing (MSMQ): several remote code execution flaws rated 8.1.

Lifecycle changes add pressure. Windows 11 23H2 Enterprise and Education receive their final update this month, and Exchange Server 2016 and 2019 extended security updates ended in October 2026, so those versions no longer appear in the release at all. Any organization still running them is now patching around a gap, not closing it. Without a risk-based process, small teams end up applying everything late or applying the wrong things first.

The fastest safe approach is to patch by exposure, not by product name. This sequence follows the vendor guidance and the patch order security researchers recommend for this release.

1. Update Office on every workstation first. CVE-2026-124194 is the only flaw under active attack. Push the Microsoft 365 Apps and Office LTSC updates and confirm the installed build (File > Office Account > About Outlook). Office LTSC 2021 should reach build 16.0.14334.21048 and Office LTSC 2024 build 16.0.17932.21140.
2. Patch domain controllers. The LDAP and Active Directory flaws make domain controllers the highest-value server target. Apply the Windows Server cumulative update in a controlled window.
3. Patch Exchange servers twice. Install the Windows cumulative update (for the Windows Search flaw) and the Exchange Server SE security update (KB5133453).
4. Patch Hyper-V hosts and remaining servers, including SQL Server and SharePoint, where several high-severity fixes landed.
5. Harden against NTLM theft while you patch. Block outbound SMB (TCP 445) to the internet, enforce SMB and LDAP signing, enable Extended Protection for Authentication, and add privileged accounts to the Protected Users group. These steps blunt hash-leak attacks even before every endpoint is updated.
6. Reduce attack surface. Disable Message Queuing where it is not used and restrict TCP 1801 where it must run.
7. Verify and hunt. Confirm patch compliance across the fleet and review logs for unexpected outbound SMB or WebDAV connections from Outlook since early November.

Egress controls in step 5 are easiest to enforce centrally. A managed SD-WAN and SASE design applies the same outbound policy to every branch, so a blocked SMB connection in headquarters is also blocked in every remote office.

A disciplined Patch Tuesday process turns a monthly emergency into a predictable routine. Organizations that treat this release as a structured project, rather than a mass deployment, gain clear advantages.

Lower breach risk. Closing the Outlook zero-day quickly removes an active attack path to user credentials. Stolen NTLM hashes are a common first step toward lateral movement and ransomware, so prompt patching directly reduces the chance of a larger incident.

Less downtime. Patching by exposure means the systems that matter most, such as domain controllers, Exchange and Hyper-V hosts, are updated in planned windows with tested rollback, instead of being rebooted at random.

Audit-ready compliance. Many regulations and cyber insurance policies ask how quickly critical and exploited vulnerabilities are remediated. Using the CISA KEV deadline as an internal service level gives auditors a clear, defensible standard.

Better visibility. A patch program built on accurate inventory exposes forgotten servers, unsupported Exchange versions and endpoints stuck on old Office channels before attackers find them.

Defense in depth. Combining patching with 24/7 SOC monitoring and managed detection and response means suspicious outbound authentication attempts are spotted even on devices that have not yet received the update. Patches close the door; monitoring tells you whether someone already tried it.

HIT Communications helps enterprises across Latin America, the United States and Europe turn months like this one into routine maintenance. With more than 30 years of experience in enterprise telecom and IT, HIT combines infrastructure operations and security under one team.

Our IT managed services cover inventory, patch testing, staged deployment and compliance reporting for Windows, Office, Exchange and server workloads, with maintenance windows planned around your business hours. Our managed cybersecurity services, including SOC, SIEM and MDR, monitor for exploitation attempts such as NTLM hash leaks and credential relay, and respond around the clock. And because HIT also designs and operates enterprise networks, we can enforce outbound security controls, such as blocking SMB to the internet, consistently across every site through SD-WAN and managed connectivity.

The result is one accountable partner for patching, detection and the network in between, instead of three vendors pointing at each other during an incident.

November 2026 Patch Tuesday is not a release to apply "when there is time." One Outlook zero-day is already exploited to steal NTLM hashes, and critical flaws in LDAP, Windows Search, Exchange and Active Directory put core infrastructure at risk. The priorities are clear: update Office everywhere, patch domain controllers and Exchange next, harden NTLM and SMB, and verify that nothing was missed.

If your team needs help prioritizing this release, closing gaps on unsupported systems, or setting up continuous monitoring, contact HIT Communications today. Our specialists can review your exposure and build a patch and security plan that keeps pace with Microsoft's monthly cycle.