Windows 11/10 November 2026 Patch Tuesday: Last 23H2 Update and an Outlook Zero-Day

What You Need to Know

• Updates: Microsoft released the November 10, 2026 security updates (Patch Tuesday) for Windows 11/10. The main Windows 11 package is KB5132061.
• Windows 11 builds: 26300.9974 (26H2), 26200.9974 (25H2) and 26100.9974 (24H2 Enterprise and Education). 26H1 gets KB5132059 (build 28000.3501). 23H2 gets KB5131087 (build 22631.7711).
• Windows 10 (ESU): KB5131096 takes 22H2 to 19045.7846 and 21H2 / LTSC 2021 to 19044.7846.
• Last update for 23H2 Enterprise and Education: Microsoft says the November 2026 security update is the last one these editions will receive. Home and Pro on 23H2 already reached end of updates earlier. 24H2 Home and Pro already stopped in October, so they do not get KB5132061.
• New features (25H2, 26H2, and 24H2 Enterprise/Education): This month’s security update includes the October 28 preview (KB5127936), so a customizable File Explorer context menu, a refreshed AutoPlay dialog, Cloud rebuild and other changes come along if you skipped the optional preview. Most of those features use a gradual rollout.
• Security: Microsoft’s November 2026 Security Updates document lists 1,094 Microsoft CVEs, including 726 in the Windows product family. In that official feed, KB5132061 is listed as a fix for 594 vulnerabilities, 33 of them rated Critical.
• Zero-day: Microsoft flags one actively exploited flaw, CVE-2026-124194, a Moderate spoofing bug in Outlook. It is not fixed by the Windows cumulative update. You need the Microsoft 365 Apps / Office security update.
• No December preview: Microsoft says there will be no December 2026 non-security preview update. Regular monthly servicing resumes in January 2027.

Microsoft’s November Patch Tuesday notes are live, and the updates are already offered through Windows Update. Install them. This month is also a lifecycle cutoff for Windows 11 23H2 Enterprise and Education, and there is an Outlook zero-day that the Windows package alone will not cover.

Which Update You Get

November is listed as a hotpatch month on Microsoft’s Windows 11 Enterprise calendar, which means enrolled PCs are due a security update that does not require a restart. At the time of writing, the official hotpatch release notes still did not list a November KB number or build, so check Windows Update for the package offered to your device. 26H1 does not support hotpatching.

Last Patch for Windows 11 23H2 Enterprise and Education

Microsoft’s KB5131087 notes are blunt: Windows 11 23H2 Enterprise and Education “have reached end of updates,” and this November security update is the last one available for those editions. After this, those PCs will no longer get monthly security updates. Microsoft recommends moving eligible devices to a supported version of Windows 11.

24H2 Home and Pro already had their last monthly update in October, so they are not in this month’s KB5132061 rollout. 24H2 Enterprise and Education stay in support and get this package.

New Features Coming With the Security Update

If you are on Windows 11 25H2 or 26H2, or on 24H2 Enterprise or Education, Microsoft’s November notes say this security update includes the improvements from the October 28 preview (KB5127936). If you already installed that optional preview, you already have these changes.

Important: Microsoft says many of the new experiences use a gradual rollout, so availability “varies by device.” You might install the update and not see everything right away.

The headline change is a customizable File Explorer context menu. Microsoft says the updated menu opens faster and is less cluttered. At the bottom of the menu, Customize menu lets you turn built-in commands such as Send to and Create shortcut on or off, add commands such as Print, choose which app extensions appear in the main menu or a submenu, show Cut, Copy, Paste, Rename, Delete and Share as regular menu items instead of a row of icons, and move Properties to the bottom. No change is required if you want the default layout. Hold Shift and right-click the desktop to see more options.

Other new or improved experiences in that preview, now in the security update, include:

• AutoPlay: A modernized dialog for phones, cameras and removable drives, with dark mode, better text scaling and AutoPlay notifications in notification center.
• File Explorer: A more consistent search results layout, support for ~ in the address bar (for example ~\AppData), and dark mode in Folder Options.
• Cloud rebuild: A recovery option under Settings > System > Recovery > Rebuild PC (or in Windows Recovery after repeated boot failures) that reinstalls Windows 11 from Windows Update, with no USB media required. You can remove files, or securely erase the drive, before Windows is reinstalled. Sanitization is irreversible.
• Magnifier: A contrast theme toggle, per-monitor zoom and viewport locking for multi-monitor setups.
• Live Captions: A new Include screen reader audio setting, off by default, so captions can ignore Narrator, JAWS and NVDA.
• Narrator: Math equation reading and navigation in supported Microsoft 365 apps and in recent versions of Edge and Chrome.
• Phone Link: Hover previews for recent messages or notifications in the Start menu’s Recent section.
• Settings: Camera, Microphone and Location controls grouped on the Privacy & security page, and the Device Info card on Settings Home expanding to more markets (Microsoft account required).
• Gaming: A refreshed Gaming Task View in Xbox mode, with a navigation bar for Exit to Desktop and Power Options (availability may depend on the device or market).
• Edge: Accelerated App Launch, so Edge opens faster when it is already running in the background. Microsoft says this is available on Windows 11 25H2, 26H2 and 26H1 with Edge 150 or later.
• Also in the preview: Unicode 17.0 text shaping, WinRE automatically reusing saved Wi-Fi profiles during recovery, a Restore Summary after you restore a backup to a new device, broader memory integrity (HVCI) enablement on eligible PCs, IPv6 CLAT support for Wi-Fi and Ethernet, and a warning that prompt-based DPAPI protect/unprotect prompts will be retired in April 2027.

Windows 11 23H2 and Windows 10 do not get this feature set. They receive the security fixes and the quality items listed in their own notes.

Fixes in This Month’s Notes

Microsoft’s November 10 notes list these quality and security-hardening changes on top of the preview content:

• USB audio: Fixes USB Audio Class 1.0 devices that failed to start and showed error code 10 in Device Manager after a recent security update. On 24H2 Enterprise and Education, Microsoft also fixed HDMI and DisplayPort playback failures on certain AMD graphics cards. On Windows 10, KB5131096 is the fix for the remaining USB audio symptoms from September (the 8-channel and 3D audio cases were already covered by the September 14 out-of-band update).
• Printing: Fixes adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device failing with error 87, “The parameter is incorrect.” Microsoft says this started with the October 2026 update and does not generally affect existing printers.
• NTLM signing: Windows 11 clients now offer NTLM message signing by default for non-anonymous connections, which helps reduce NTLM relay attacks and adds auditing for connections that are not using signing.
• Remote Desktop: On 25H2, 26H2, 26H1 and 24H2 Enterprise/Education, Microsoft fixed RDP connections that could fail because of a certificate mismatch after the October preview. On 23H2 and Windows 10, the “Specify thumbprints of certificates representing trusted .rdp publishers” policy can again be configured through Intune.
• PowerShell: Stricter encoding checks for signed scripts. Scripts with invalid UTF-8 encoding may fail signature validation, even if they worked before. Microsoft says to save those scripts as UTF-8 with a BOM and sign them again.
• Cuba time zone: DST rules are updated for Cuba’s extended 2026-2027 DST period. Cuba stays on UTC-04:00 and does not observe the November 2026 or March 2027 transitions.
• Secure Boot: Microsoft is still widening the set of devices that automatically receive the newer Secure Boot certificates. PCs that have not received them yet can still start and still get Windows updates.
• Copilot+ PCs: AI components (Image Search, Content Extraction, Semantic Analysis and Settings Model) go to version 1.2610.1063.0 on 24H2, 25H2 and 26H2, and 1.2610.1071.0 on 26H1.

Security Fixes and the Outlook Zero-Day

This is a large Patch Tuesday. Microsoft’s official November 2026 Security Updates document lists 1,094 Microsoft CVEs, with 726 in the Windows product family, plus 174 in Office and smaller counts across Exchange, SharePoint, SQL Server and other products. Microsoft is also republishing 165 non-Microsoft CVEs (Chrome CVEs are not listed in that republish total).

In that same official feed, KB5132061 is listed as a fix for 594 vulnerabilities, 33 of them rated Critical. Those Critical Windows issues include remote code execution in TCP/IP, SMB, the Print Spooler, Windows Search, Message Queuing, Schannel, LDAP and CredSSP, plus elevation of privilege bugs in Hyper-V, the graphics kernel and TPM. None of the Windows CVEs is marked as exploited.

The one exploited bug is in Outlook, not in the Windows cumulative update:

• CVE-2026-124194, Microsoft Outlook spoofing (Exploitation Detected): Microsoft rates it Moderate (CVSS 3.1 base score 6.5) and says it was not publicly disclosed before the fix. An attacker can send a specially crafted message file and trick someone into opening it in a vulnerable version of Outlook. Opening the file can make Outlook connect to an attacker-controlled server without the usual external-content warning, which can leak the user’s NTLMv2 hash. Microsoft says the Preview Pane is not an attack vector, and user interaction is required. The fix ships in the Microsoft 365 Apps and Office LTSC security updates, not in KB5132061. Customer action is required.

If you use Outlook, install the Office / Microsoft 365 Apps update as well as the Windows update.

Microsoft’s feed marks every CVE in this release as not publicly disclosed. There is no second exploited bug in the November document.

Known Issues

For KB5132061, KB5132059 and KB5131087, Microsoft says it is not currently aware of any issues.

The Windows 10 KB5131096 notes still describe the USB Audio Class 1.0 problem (Device Manager error code 10, no sound, or volume controls stuck at zero). Microsoft also says the remaining symptoms are addressed in KB5131096, after the September 14 out-of-band update covered 8-channel and 3D audio modes.

No December Preview Update

On the Windows 11 26H2, 25H2, 24H2 and 26H1 notes, Microsoft says there will be no December 2026 non-security preview update because of reduced operations during the Western holidays and the new year. Monthly security and preview servicing resumes in January 2027. The December security update is still expected on the usual Patch Tuesday schedule. That is not called off.

How to Install

1. Open Settings (Windows + I).
2. Go to Windows Update.
3. Select Check for updates.
4. Install everything offered, then restart if Windows asks you to.

If you use Outlook or Microsoft 365 Apps, also open Work or school updates (or Office account / Update Options) and make sure the Office security update is installed.

You can also grab the standalone packages from the Microsoft Update Catalog. On Windows 10, commercial 22H2 devices need a valid ESU Year 2 license to receive KB5131096.

Source: Microsoft, Security Update Guide