November 2026 Patch Tuesday: Windows Admin Priorities

Microsoft released the November 2026 Patch Tuesday updates on 10 November 2026. There is one exploited zero-day: CVE-2026-124194, an Outlook spoofing vulnerability that can leak a user's NTLMv2 hash. It needs an Office/Outlook patch, separate from the Windows cumulative update. The Windows packages bring NTLM signing and PowerShell signature changes, fixes for printing, Remote Desktop, Exchange OWA/Outbox/replication and USB Audio 1.0, plus a WSUS diagnostic limitation to allow for. Windows 11 23H2 Enterprise and Education receive their last update this month.

Cumulative updates by Windows version: KB5132061 (Windows 11 26H2/25H2/24H2) · KB5131087 with SSU KB5132696 (Windows 11 23H2) · KB5132059 (Windows 11 26H1) · KB5131096 (Windows 10) · KB5131080 (Server 2025) · KB5131077 (Server 2025 Hotpatch) · KB5131090 (Server 2022) · KB5131085 with SSU KB5131084 (Server 2019) · KB5131291 with SSU KB5131083 (Server 2016)

November 2026 Patch Tuesday CVEs: the counts and the zero-day

Microsoft's November Security Update Guide release note reports 1,094 Microsoft CVEs and 165 republished non-Microsoft CVEs, with Chrome CVEs not listed. The 2026-Nov CVRF marks one CVE as exploited and 0 as publicly disclosed. These counts describe the release, not a count of Windows packages to approve.

Exploited: CVE-2026-124194, Microsoft Outlook Spoofing Vulnerability, Moderate, CVSS 3.1 base 6.5. An attacker sends a specially crafted message file and convinces the user to open it in affected Outlook. Outlook connects to an attacker-controlled network location without the usual external-content warning, potentially disclosing the user's NTLMv2 hash. User interaction is required; the Preview Pane is not an attack vector.

The Moderate rating does not change the deployment priority: Microsoft records exploitation. Track the affected Outlook installation and its Office update separately. Installing KB5132061, KB5131087 or another Windows LCU is not evidence that this Outlook vulnerability is patched. Use the MSRC record for the affected product and remediation, rather than assigning this CVE to a Windows KB.

For ring design, reuse the Patch Tuesday Intune and WUfB operations guide. This page is the November-specific briefing.

November 2026 Patch Tuesday KBs and builds to verify

Use the KB and OS build as the compliance target. An assigned quality-update policy is not proof the device is running the November build. Keep the Server 2025 cumulative update and Hotpatch targets separate.

The cumulative updates and their servicing stack updates are listed per version under Cumulative updates by Windows version.

Hardening and behaviour changes to test

NTLM clients offer message signing by default

KB5132061, KB5131087, KB5132059, KB5131080 and KB5131090 make clients offer NTLM message signing by default for non-anonymous connections. Microsoft describes reduced NTLM relay exposure and additional auditing. Include applications that still use NTLM in pilot and review authentication results before broad deployment. Do not use this Windows change as proof that the exploited Outlook flaw has been fixed; that requires the Office/Outlook patch.

Signed PowerShell scripts: save as UTF-8 with BOM and re-sign

The Windows packages listed below, other than the Server 2025 Hotpatch block, document stricter UTF-8 validation for PowerShell script signatures. Scripts containing invalid UTF-8 can fail signature validation. Microsoft's guidance is to save as UTF-8 with BOM and re-sign. Test signed deployment, maintenance and remediation scripts before promoting a ring; an encoding change alone is not the complete fix. The KBs refer to "Encoding Guidance for Signed PowerShell Scripts".

Cuba daylight saving time

The packages below, other than the Hotpatch block, document Cuba's revised rules: it stays at UTC-04:00, with no November 2026 or March 2027 transition, returns to UTC-05:00 in November 2027, and resumes the regular schedule in 2028. Include Cuba-local scheduled work and calendar-dependent processes in validation.

Secure Boot targeting data

KB5132061, KB5131087 and KB5132059 add high-confidence device targeting data for Secure Boot. Keep Secure Boot checks in the client pilot and record the device cohort alongside the installed build. This is a targeting-data change in the Windows KBs; keep it distinct from the Outlook remediation.

Windows 11 23H2 Enterprise and Education reach end of updates

Microsoft's KB5131087 banner says Windows 11, version 23H2 Enterprise and Education "have reached end of updates" and that "The November 2026 Windows security update is the last update available for these editions". Microsoft directs admins to update eligible devices to a supported version of Windows 11.

Install the final quality update while planning the move. A successful November install does not remove the feature-update task. Use the October servicing deadlines briefing for inventory planning and the 26H2 enablement package pilot gate where that is your chosen target.

No December 2026 non-security preview

KB5132061, KB5132059 and the Windows message center state there will be no December 2026 non-security preview update in the second part of the month, because of minimal operations during the Western holidays and the upcoming new year. Normal monthly servicing for both security and non-security preview updates resumes in January 2027.

What to patch first

1. Affected Outlook installations, especially on privileged workstations. CVE-2026-124194 is exploited. Deploy the applicable Office/Outlook fix and keep its completion evidence separate from Windows compliance.
2. Exchange hosts, through a controlled Windows pilot. The Server LCUs (KB5131080, KB5131090, KB5131085, KB5131291) include an Exchange OWA / Outbox / mailbox-replication fix. Microsoft still lists the issue under Known issues, with the Resolution stating it is resolved in the 10 November 2026 Windows updates. Capture OWA sign-in, send/receive, Outbox, replication and queue health before and after patching; agree a rollback decision with the service owner before expanding.
3. Windows 11 23H2 Enterprise and Education. Deploy KB5131087 and assign the supported-version migration. This is the final update for these editions.
4. Devices with printing, RDP or USB audio symptoms. Use the platform-specific block below. Windows 11 26H2/25H2/24H2 and 26H1 list the USB Audio 1.0 Code 10 fix in improvements. KB5131096, KB5131085 and KB5131291 still list the issue under Known issues, with Microsoft's Resolution stating the remaining symptoms are addressed in those November packages (the 14 September OOB addressed 8-channel and 3D audio). Test the actual peripherals and connection paths.
5. The remaining Windows client and server fleet through normal rings. Include NTLM-dependent applications, signed PowerShell scripts and Cuba-local scheduling in acceptance checks. Keep Server 2025 Hotpatch eligibility and its baseline separate from the full LCU path.

Cumulative updates by Windows version

Each block is taken from Microsoft's KB article for that package, re-fetched on 10 November 2026. Known issues are the issues Microsoft lists at that time. Where Microsoft still lists an issue under Known issues, follow the Resolution text; keep a controlled validation check even when that Resolution points at this update.

KB5132061 (SSU KB5132688): Windows 11, versions 26H2, 25H2 and 24H2

• Applies to: Windows 11, versions 26H2 and 25H2, all editions; version 24H2, Enterprise and Education only
• OS build: 26300.9974 / 26200.9974 / 26100.9974, with combined SSU KB5132688 (26100.9971)
• Released: 10 November 2026
• What's in it: security updates; Secure Boot targeting data; fixes for USB Audio 1.0 devices failing with Device Manager Code 10, AD-published printers failing to add through Settings with error 87, and RDP certificate-mismatch connection failures after the October non-security preview. It adds NTLM signing by default, Cuba DST changes and stricter PowerShell UTF-8 signature validation. On 24H2 it also fixes HDMI/DisplayPort audio playback on certain AMD graphics cards. Includes improvements from KB5127648, OOB KB5134133 and preview KB5127936.
• Known issues listed by Microsoft: none listed by Microsoft at time of writing.
• Prerequisites: 26H2 needs an update from 22 September 2026 or later, such as KB5124010, and SSU 26100.9539 or later. 24H2/25H2 need an update from 10 June 2025 or later, such as KB5060842, and SSU 26100.4193 or later.
• Microsoft KB: KB5132061 on Microsoft Support

KB5131087 (SSU KB5132696): Windows 11, version 23H2

• Applies to: Windows 11, version 23H2
• OS build: 22631.7711, with SSU KB5132696 (22621.7698)
• Released: 10 November 2026
• What's in it: security updates, Secure Boot targeting data, the printer error 87 fix, NTLM signing by default, Cuba DST changes and PowerShell UTF-8 signature validation. It fixes configuring the "Specify thumbprints of certificates representing trusted .rdp publishers" policy through Intune. Includes KB5126653 and OOB KB5134130.
• Known issues listed by Microsoft: none listed by Microsoft at time of writing.
• Lifecycle: Microsoft says 23H2 Enterprise and Education have reached end of updates; this is the last update available for these editions.
• Prerequisites: an update from 8 July 2025 or later, such as KB5062552, and SSU 22621.5619 or later.
• Microsoft KB: KB5131087 on Microsoft Support

KB5132059 (SSU KB5132687): Windows 11, version 26H1

• Applies to: Windows 11, version 26H1
• OS build: 28000.3501, with SSU KB5132687 (28000.3501)
• Released: 10 November 2026
• What's in it: security updates, Secure Boot targeting data, USB Audio 1.0 Code 10 and printer error 87 fixes, NTLM signing by default, Cuba DST changes, the RDP certificate-mismatch fix and PowerShell UTF-8 signature validation. Includes KB5127646, OOB KB5134134 and preview KB5127653.
• Known issues listed by Microsoft: none listed by Microsoft at time of writing.
• Prerequisites: SSU 28000.1575 or later.
• Microsoft KB: KB5132059 on Microsoft Support

KB5131096 (SSU KB5132689): Windows 10 ESU and LTSC 2021

• Applies to: Windows 10 ESU, version 22H2; Windows 10 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021, version 21H2
• OS build: 19045.7846 / 19044.7846, with SSU KB5132689 (19041.7838)
• Released: 10 November 2026
• What's in it: Cuba DST changes, the printer error 87 fix, the Intune .rdp publisher thumbprint policy fix and PowerShell UTF-8 signature validation. It fixes RDP shadow connections returning "Unspecified error" on Windows Server 2016 / 2012 R2 after the 14 October 2026 update. Includes KB5126657 and OOB KB5134125.
• Known issues listed by Microsoft: USB Audio Class 1.0 devices are listed under Known issues (Code 10 or no output after the 8 September 2026 update). Microsoft's Resolution says the 14 September OOB (KB5129236) addressed 8-channel and 3D audio symptoms, and that the remaining symptoms are addressed in KB5131096. Test the actual devices; do not treat the known-issue heading as meaning the issue is still open.
• Lifecycle: Microsoft's KB5131096 banner says free support for Windows 10 Enterprise LTSC 2021 ends on 12 January 2027.
• Microsoft KB: KB5131096 on Microsoft Support

KB5131080 (SSU KB5131079): Windows Server 2025

• Applies to: Windows Server 2025
• OS build: 26100.33822, with SSU KB5131079 (26100.33822)
• Released: 10 November 2026
• What's in it: fixes for certificate enrollment handles and key-type flags, printer error 87, Intune .rdp publisher policy, Exchange OWA sign-in / Outbox / mailbox replication, and the Server 2016-to-2025 in-place upgrade compatibility failure 0x80070003 - 0x40008. RD Web Access pages are now server-rendered to address failure when browser policy disables XSLT (KB5130994). It adds NTLM signing by default, Cuba DST changes and PowerShell UTF-8 validation. HideRecommendedSection now applies to Windows 11 Enterprise multi-session / AVD / ServerRDSH; Import-WdsInstallImage requires admin privileges, addressing ACCESS_DENIED. Includes KB5126646 and OOB KB5134137.
• Known issues listed by Microsoft:
  • Exchange OWA sign-in / sending / Outbox / mailbox replication is listed under Known issues, with Microsoft's Resolution stating it is resolved in Windows updates released on and after 10 November 2026, including KB5131080. The improvements list also describes this as an Exchange fix. Symptoms Microsoft records for the earlier issue include MapiExceptionMdbOffline (hr=0x80004005, ec=1142), Event ID 1006 and growing queues. October Exchange SUs are not required for the issue to have occurred. Validate on a controlled Exchange pilot; see Known issues to test.
  • WSUS does not display synchronisation error details after KB5070881 or later.
• Microsoft KB: KB5131080 on Microsoft Support

KB5131077 (SSU KB5131079): Windows Server 2025 Hotpatch

• Applies to: Windows Server 2025 Datacenter: Azure Edition, and Datacenter and Standard connected to Azure Arc
• OS build: 26100.33730, with SSU KB5131079 (26100.33822)
• Released: 10 November 2026
• What's in it: the Import-WdsInstallImage admin-privilege / ACCESS_DENIED fix.
• Known issues listed by Microsoft: WSUS does not display synchronisation error details after KB5070893 or later.
• Prerequisites: baseline KB5127648 and SSU 26100.9703 or later.
• Microsoft KB: KB5131077 on Microsoft Support

KB5131090 (SSU KB5131089): Windows Server 2022

• Applies to: Windows Server 2022
• OS build: 20348.5870, with SSU KB5131089 (20348.5859)
• Released: 10 November 2026
• What's in it: Cuba DST changes, Exchange fixes, printer error 87 and .rdp publisher policy fixes, server-rendered RD Web Access for the XSLT issue, NTLM signing by default, the WDS Import-WdsInstallImage fix and PowerShell UTF-8 validation. Includes KB5126655 and OOB KB5134140.
• Known issues listed by Microsoft: Microsoft lists the Exchange OWA / Outbox / replication issue under Known issues, with the Resolution stating it is resolved in Windows updates released on and after 10 November 2026, including KB5131090. Validate on a controlled Exchange pilot; see Known issues to test. WSUS does not display synchronisation error details after KB5070884 or later.
• Lifecycle: Microsoft's KB5131090 banner says Windows Server 2022 has reached end of mainstream support, and that the October 2026 security update is the last mainstream support update. After that date it transitions to extended support, with monthly security updates through 14 October 2031.
• Prerequisites: an update from 8 July 2025 or later, such as KB5062572, and SSU 20348.3920 or later.
• Microsoft KB: KB5131090 on Microsoft Support

KB5131085 (SSU KB5131084): Windows Server 2019 and Windows 10 Enterprise LTSC 2019

• Applies to: Windows Server 2019 / Windows 10 Enterprise LTSC 2019
• OS build: 17763.9487, with SSU KB5131084 (17763.9478)
• Released: 10 November 2026
• What's in it: Cuba DST changes, printer error 87 and WDS cmdlet fixes, server-rendered RD Web Access for the XSLT issue, the .rdp publisher policy fix, Exchange fixes and PowerShell UTF-8 validation. It fixes RDP shadow connections returning "Unspecified error" on Server 2016 / 2012 R2 after the 14 October 2026 update. Includes KB5126651 and OOB KB5134124.
• Known issues listed by Microsoft: Microsoft lists the Exchange OWA issue under Known issues, with the Resolution stating it is resolved in Windows updates released on and after 10 November 2026, including KB5131085. USB Audio Class 1.0 Code 10 / no-output symptoms are also listed, with the Resolution stating the 14 September OOB addressed 8-channel and 3D audio and that the remaining symptoms are addressed in KB5131085. See Known issues to test.
• Microsoft KB: KB5131085 on Microsoft Support

KB5131291 (SSU KB5131083): Windows Server 2016 and Windows 10 LTSB 2016 ESU

• Applies to: Windows Server 2016 / Windows 10 LTSB 2016 ESU
• OS build: 14393.9688. The SSU ships separately as KB5131083; include the separate SSU in the deployment plan.
• Released: 10 November 2026
• What's in it: Cuba DST changes, printer error 87 and WDS cmdlet fixes, .rdp publisher policy and shadow-connection fixes, server-rendered RD Web Access for the XSLT issue, Exchange fixes and PowerShell UTF-8 validation. Includes KB5126868 and OOB KB5134123.
• Known issues listed by Microsoft: Microsoft lists the Exchange OWA issue under Known issues, with the Resolution stating it is resolved in Windows updates released on and after 10 November 2026, including KB5131291. USB Audio Class 1.0 is also listed, with the Resolution stating the remaining symptoms are addressed in KB5131291. See Known issues to test.
• Microsoft KB: KB5131291 on Microsoft Support; separate SSU KB5131083

Intune and Configuration Manager deployment tips

Intune / WUfB. Use canary, pilot and broad rings, with the application and peripheral checks above as promotion criteria. Verify the installed build and track Outlook remediation separately. Keep the 23H2 feature-update task visible alongside quality-update compliance.

Configuration Manager / WSUS. Keep the Server 2025 LCU and Hotpatch cohorts distinct. Check the separate Server 2016 SSU and the Windows 11 servicing prerequisites before deployment. Missing WSUS synchronisation error details are a listed known issue on the Server packages above; do not treat an empty details view as evidence of a healthy sync.

Quick device check:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
    Select-Object DisplayVersion, CurrentBuild, UBR

Get-HotFix |
    Where-Object { $_.HotFixID -in @(
        'KB5132061','KB5131087','KB5132059',
        'KB5131096','KB5131080','KB5131077',
        'KB5131090','KB5131085','KB5131291'
    ) } |
    Select-Object HotFixID, InstalledOn

Compare CurrentBuild and UBR together against the table. Record the platform, installed KB and application test results before promoting a ring. The Windows inventory above does not verify the Office/Outlook patch.

Known issues to test

• Exchange OWA / Outbox / mailbox replication (KB5131080, KB5131090, KB5131085, KB5131291): Microsoft documents this as fixed by the 10 November 2026 Server LCUs (improvements list plus a Known issues Resolution pointing at this update). Still test sign-in, sending, Outbox, replication and queue growth before promoting a ring. Historical symptoms include MapiExceptionMdbOffline (hr=0x80004005, ec=1142) and Event ID 1006. Installing the October Exchange SUs was not required for the issue to occur. Do not use a registry workaround as current Microsoft guidance; that language is not in the November KB pages fetched on 10 November 2026.
• USB Audio Class 1.0: KB5132061 and KB5132059 list the Code 10 startup fix in improvements and list no open known issues. KB5131096, KB5131085 and KB5131291 still list the issue under Known issues, with the Resolution stating the remaining symptoms are addressed in those November packages (the 14 September OOB addressed 8-channel and 3D audio). Test the actual conference-room and headset hardware for each platform.
• WSUS synchronisation error details: KB5131080, KB5131077 and KB5131090 list missing details. Keep this diagnostic limitation in the sync investigation; an absent error description is not a successful synchronisation result.

Microsoft lists no known issues at time of writing for KB5132061, KB5131087 or KB5132059. Re-check the linked Microsoft KB for each package before broad deployment.

FAQ

What is the November 2026 Patch Tuesday KB for Windows 11?

KB5132061 for 26H2/25H2 and 24H2 Enterprise/Education (26300.9974 / 26200.9974 / 26100.9974), KB5131087 for 23H2 (22631.7711), and KB5132059 for 26H1 (28000.3501).

Are there zero-days in November 2026 Patch Tuesday?

Yes, one exploited zero-day: Outlook spoofing CVE-2026-124194, Moderate, CVSS 6.5. It can disclose an NTLMv2 hash after a user opens a specially crafted message file. The Preview Pane is not an attack vector. Microsoft marks 0 CVEs as publicly disclosed.

Does the Windows cumulative update fix CVE-2026-124194?

No. It is an Office/Outlook vulnerability. Deploy the applicable Office/Outlook patch separately and verify it against the MSRC record.

How many CVEs are in the November release?

The release note reports 1,094 Microsoft CVEs and 165 republished non-Microsoft CVEs, with Chrome CVEs not listed. Use those release-note figures; Microsoft can revise the release.

Is this the last update for Windows 11 23H2 Enterprise and Education?

Yes. Microsoft says these editions have reached end of updates and the November 2026 Windows security update is the last available. Move eligible devices to a supported Windows 11 version.

Are the Exchange and USB audio issues resolved?

Microsoft documents both as fixed by the 10 November 2026 packages: the Server LCUs resolve the Exchange OWA / Outbox / replication issue, and the remaining USB Audio 1.0 symptoms are addressed in KB5132061, KB5132059, KB5131096, KB5131085 and KB5131291 (the 14 September OOB had already addressed 8-channel and 3D audio). Microsoft still lists some of these under Known issues, with a Resolution pointing at this update. Validate by platform before promoting a ring. The WSUS missing-sync-details limitation on KB5131080, KB5131077 and KB5131090 remains an open known issue.

Related reading

• Patch Tuesday operations for Intune and WUfB
• October 2026 Patch Tuesday admin priorities
• September 2026 Patch Tuesday admin priorities
• October 2026 Windows servicing deadlines
• Windows 11 26H2 enablement package pilot gate
• Patch management hub