Microsoft fixes more than 1,100 bugs in its November security updates. One flaw in Outlook is already being actively exploited today.
Check whether your Windows laptop has accidentally got stuck on Windows 11 24H2 or older, because those editions of Windows have stopped receiving security updates since last month (click Start, type winver and press enter). You don’t want to miss the November patches, though: Redmond is closing more than 1,100 vulnerabilities in one go.
KB5132061 fixes 1,094 Microsoft-related CVEs. Most of them (726) are in Windows, with Office in second place (174 bugs). Microsoft also fixes several Chromium issues in Edge. Including the 165 non-Microsoft CVEs, the November updates fix 1,259 issues.
AI and updates
The number of security issues Microsoft addresses with its monthly patches has risen sharply in recent months. This is largely down to AI. AI models help developers find bugs that previously went unnoticed. Criminals can also use AI to find and exploit vulnerabilities quickly. As a result, the time between the discovery of a bug and its exploitation has shrunk from weeks to hours.
This batch of patches is no exception. One of the vulnerabilities fixed is CVE-2026-124194 in Outlook. This bug allows spoofing and is already being actively exploited at this moment.
Windows updates install automatically by default. Make sure that is the case: these days, the risk of postponing is greater than the admittedly real risk that Microsoft breaks something itself with its patches. At the moment, there are no known problems with the November updates, apart from a minor bug that prevents the patches from installing. In principle, it resolves itself without manual intervention.