November 2026 Patch Tuesday Known Issues and Updates
Microsoft released the November 2026 security updates for Windows on Tuesday, November 10. This post lists the cumulative updates for Windows 11 and Windows 10, the known issues that affect them, and the vulnerability Microsoft marks as exploited. I'll update the tables on November 12 and November 17 as Microsoft adds or closes known issues.
The November update is the last update for Windows 11 version 23H2 Enterprise and Education, according to the Windows message center. Devices on 23H2 Enterprise or Education need a newer version of Windows 11 to keep getting security updates.
Cumulative updates
| Version | KB | OS build | Source |
|---|---|---|---|
| Windows 11 26H2, 25H2, and 24H2 | KB5132061 | 26300.9974, 26200.9974, and 26100.9974 | Microsoft KB5132061 |
| Windows 11 23H2 | KB5131087 | 22631.7711 | Microsoft KB5131087 |
| Windows 10 22H2 and Enterprise LTSC 2021 (Extended Security Updates) | KB5131096 | 19045.7846 and 19044.7846 | BleepingComputer |
The Windows Server KB numbers and builds weren't on Microsoft's pages when I checked on the afternoon of November 10. They'll be added in the November 12 update.
Exploited and publicly disclosed vulnerabilities
Microsoft marks one vulnerability as exploited this month. CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook with a CVSS score of 6.5. An attacker who gets a user to open a crafted Office file or message can make Outlook send the user's NTLMv2 hash to a server the attacker controls. The attacker can use the hash to impersonate the user. ZDI reports no publicly disclosed vulnerabilities from Microsoft this month.
| CVE | Product | Exploited | Publicly disclosed | Source |
|---|---|---|---|---|
| CVE-2026-124194 | Microsoft Outlook (Microsoft 365 Apps for Enterprise and Office), spoofing | Yes | No | Tenable, ZDI, Krebs on Security |
Known issues
Microsoft had listed no new known issue for the November updates when I checked, according to BleepingComputer. The issues below started with earlier updates and still apply to devices that haven't installed the fix.
| KB | Affected | Symptom | Workaround | Status | Source |
|---|---|---|---|---|---|
| October 2026 updates for Windows Server (KB5126646, KB5126655, KB5126651, and KB5126868) | Windows Server 2025, 2022, 2019, and 2016 running Exchange Server | Users can't sign in to Outlook on the web or send mail. Mail stays in the Outbox. | Microsoft's Exchange team says not to uninstall the October updates. Run reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f from an elevated prompt and restart the server. | Mitigated. Not updated for November as of November 10. | Exchange Team blog, Windows Server 2025 release health |
| September 2026 updates (KB5124008 for Windows 11, KB5122871 for Windows Server 2025) | Windows 11, Windows 10, and Windows Server with USB Audio Class 1.0 devices | USB audio devices fail to start or play no sound. | The September 14 out-of-band updates fixed only the 8-channel and 3D audio symptoms. BleepingComputer reports the November updates fix the remaining symptoms. | Mitigated on Microsoft's release health pages, last updated September 29. The November fix is not yet confirmed there. | Windows 11 25H2 release health, BleepingComputer |
| September 22 preview (KB5124010) | Windows 11 26H2, 26H1, 25H2, and 24H2 | Users who aren't administrators can't connect over Remote Desktop to a device with Administrator protection turned on. The error is 0xC000000D. | Install KB5127936 (October 28) or a later update. | Resolved in KB5127936. | Windows 11 25H2 release health |
Other changes in this release
- The Windows 10 update KB5131096 updates Cuba's daylight saving time rules. Cuba stays on UTC-04:00.
- KB5131096 also fixes adding a printer published in Active Directory, which could fail with error 87 after the October update.
- KB5132061 adds a warning to prompt-based DPAPI protect and unprotect operations. Microsoft plans to retire prompt-based DPAPI operations in April 2027.
- KB5132061 can turn on memory integrity on eligible devices during the update. It keeps a setting that a user or administrator already chose.
The sources for these changes are the BleepingComputer articles on KB5132061 and KB5131087 and on KB5131096.
ET Ducky's rollout rings pause a deployment when services fail after the reboot. The patch management documentation covers how rings are set up.
Patch in rings
Set up rollout rings and maintenance windows for Windows and Linux updates in ET Ducky.
Read the patch management docs