Microsoft released its November 2026 Patch Tuesday security updates on 11 November, addressing
1,093 CVEs with 63 rated critical and 1,029 rated as important
. For Kent SMEs, this month’s release carries particular urgency:
Microsoft patched one Microsoft Outlook zero-day flaw (CVE-2026-124194) that was exploited
before the fix became available. With
1,831 reports of cyberattacks received by the NCSC between 1 September 2025 and 31 August 2026, including 80 classified as nationally significant
, unpatched systems remain a primary entry point for attackers targeting UK businesses.
CVE-2026-124194: Actively Exploited Outlook Zero-Day Exposes Authentication Credentials
Microsoft patched a Microsoft Outlook Spoofing zero-day vulnerability that was actively exploited in attacks to steal NTLM account hashes
. The vulnerability, tracked as CVE-2026-124194, carries
a CVSS severity score of 6.5
and requires user interaction to trigger.
The vulnerability could expose users’ authentication credentials after opening a specially crafted malicious file
, though
Microsoft explicitly rules out the Preview Pane as an attack vector
. For Kent SMEs using Outlook for business communication, this zero-day represents a direct credential theft risk that attackers have already exploited in the wild.
What NTLM Credential Theft Means for Your Business
NTLM (NT LAN Manager) authentication hashes can be captured and used in pass-the-hash attacks, allowing attackers to authenticate to other systems on your network without needing to crack the actual password. Once inside, threat actors can move laterally across your infrastructure, accessing file shares, databases and other resources using the stolen credentials.
This attack vector is particularly dangerous for SMEs because it requires minimal sophistication once the initial credential is obtained. The NCSC’s recent warnings about identity security underscore why credential protection must be a priority, especially when zero-day flaws provide attackers with new exploitation routes.
November 2026 Patch Tuesday: Critical Vulnerabilities Across Microsoft Products
Beyond the Outlook zero-day,
Microsoft addressed 1,093 newly disclosed vulnerabilities including 535 elevation-of-privilege flaws, 296 remote code execution issues, 156 information disclosure bugs, 46 denial-of-service vulnerabilities, 27 security feature bypasses, 22 spoofing flaws, and 11 tampering issues
.
Exchange Server, SharePoint and Outlook Receive Critical Fixes
-
CVE-2026-118207 in Exchange Server
represents a critical remote code execution vulnerability affecting on-premises email servers - CVE-2026-120002 is an EoP vulnerability affecting Microsoft SharePoint Server
- Outlook receives patches for three Critical RCE flaws: CVE-2026-111309, CVE-2026-110068, and CVE-2026-110043
- Microsoft Defender receives a Critical RCE fix, CVE-2026-122194
For Kent businesses still running on-premises Exchange Server—particularly following the October 2026 ESU Period 2 deadline—the Exchange Server RCE vulnerability demands immediate attention.
Windows Components and Infrastructure Services
Hyper-V has eight Critical privilege escalation flaws, making virtual infrastructure a priority
for organisations using Microsoft’s virtualisation platform.
Other server fixes include CVE-2026-113825 in the SMB Server transport driver, CVE-2026-113859 in TCP/IP, and CVE-2026-119958 in LDAP
—all fundamental Windows Server components that underpin file sharing, network connectivity and directory services.
Record-Breaking Patch Volume: Why November 2026 Matters
Different sources report varying totals—
1,235 flaws according to BleepingComputer when including all updates
—but the November 2026 release is unquestionably substantial.
November’s Patch Tuesday comes after a record-breaking 1,411 flaws in the October updates as Microsoft continues to use AI to find and patch vulnerabilities
.
This trend reflects Microsoft’s increasingly automated approach to vulnerability discovery, using AI-assisted code analysis to identify security flaws across its vast codebase. For IT teams at Kent SMEs, the operational challenge is clear: patch volumes are rising, not falling, and maintaining a disciplined update cadence is no longer optional.
What Kent SMEs Must Do This Week
1. Prioritise the Outlook Zero-Day (CVE-2026-124194)
Deploy the November 2026 Outlook updates immediately to all users. Because the vulnerability was exploited before the patch became available, assume threat actors have working exploit code and will continue targeting unpatched systems. User training should emphasise avoiding suspicious file attachments, though email filtering and endpoint protection remain your primary technical controls.
2. Patch Exchange Server, SharePoint and Windows Server Infrastructure
Schedule patching for on-premises Exchange Server and SharePoint within your next maintenance window—ideally within 48–72 hours. The critical RCE vulnerabilities in these platforms make them high-value targets. Windows Server systems running Hyper-V, SMB, TCP/IP and LDAP services should follow immediately after.
3. Deploy Windows Client Updates Across All Devices
Both Windows packages resolve a problem that prevented some USB Audio 1.0 devices from starting and Windows clients now offer NTLM message signing by default for non-anonymous connections, reducing exposure to relay attacks
. Test updates on a small pilot group first, especially given the recent history of Windows update issues, then roll out to all workstations.
4. Review Patch Deployment Processes
With Microsoft now releasing patches at this scale monthly, manual update processes will not scale. Kent SMEs should evaluate:
- Automated patch management tools, either built into Microsoft 365 or third-party solutions
- Defined maintenance windows with clear rollback procedures
- Pilot testing groups that represent your hardware and software diversity
- Service-level agreements with IT support providers that specify patch deployment timeframes
5. Strengthen Identity and Credential Security
The Outlook zero-day’s credential theft mechanism underscores the importance of defence-in-depth for identity. Implementing multi-factor authentication (MFA) across all user accounts—particularly Microsoft 365 and on-premises Active Directory—limits the damage attackers can cause even if they obtain NTLM hashes. The NCSC’s recent warnings about identity security should inform your approach.
The Broader Security Context: NCSC Annual Review Highlights Rising Threat
November’s Patch Tuesday arrives as the NCSC published its Annual Review 2026, revealing
1,831 reports of cyberattacks between 1 September 2025 and 31 August 2026, with 337 incidents requiring support from the NCSC’s Incident Management Team, including 80 classified as nationally significant
. The agency
notified approximately 8,500 organisations of suspected compromises through its Early Warning service
.
The agency warns that organisations frequently remain exposed to vulnerabilities for which security updates are already available
—making timely patching one of the most cost-effective security controls available to SMEs. When zero-day vulnerabilities like CVE-2026-124194 emerge, the window between public disclosure and widespread exploitation can be measured in hours, not days.
Get Expert Support for Microsoft Patch Management
Meridian Micro manages security updates for Kent SMEs across Windows, Microsoft 365, Exchange Server and SharePoint environments. Our Business IT Support in Kent includes proactive patch management with testing, deployment and rollback procedures tailored to your infrastructure and business continuity requirements.
If you need help deploying November’s critical updates or establishing a disciplined patch management process that scales with Microsoft’s increasing release volumes, call our Saltwood team on 01303 883111. We’ll assess your current update posture, identify high-risk gaps and implement the controls necessary to keep your systems secure without disrupting business operations.