This is the follow-up to yesterday's preview. November Patch Tuesday has landed, the dust is settling, and here's what matters: 1,235 vulnerabilities fixed, one actively exploited Outlook zero-day, two long-standing bugs finally resolved, and some genuinely useful Windows 11 features. Below are the KB numbers, what's broken, what's fixed, and what you need to do today.
🔴 The Outlook Zero-Day — Actively Exploited, Patch Now
An Outlook spoofing vulnerability is being used in the wild right now to steal Windows credentials. The attack requires nothing more than opening a malicious email attachment. This was exploited before the fix was available.
Here's how it works: an attacker sends a specially crafted file to someone in your organization. The target opens it in Outlook. Normally, Outlook would show a warning before connecting to external content — but this vulnerability bypasses that warning entirely.
When the file opens, Outlook quietly connects to an attacker-controlled server in the background. Windows automatically tries to authenticate to that server and sends the user's NTLMv2 credential hash — a hashed version of their Windows password. The attacker captures that hash, cracks it offline, and now has that employee's credentials.
What can they do with those credentials? Log into email, VPN, file shares, or anything else that uses Windows authentication. For a small or mid-sized business, that's often everything.
This is not theoretical. It was being actively exploited before Microsoft released the fix yesterday.
What to do: Install November's cumulative updates on every Windows machine. Restart after installing — the patch isn't active until the system reboots. Remind your team to be cautious with email attachments, even from known senders.
📋 The KB Numbers — What to Install
Here's what Microsoft released and what each update covers:
| Update | Applies To | Notes |
|---|---|---|
| KB5132061 | Windows 11 26H2 / 25H2 / 24H2 | Main cumulative update. Includes Outlook zero-day fix, USB audio fix, new features (customizable right-click menu, File Explorer improvements, modernized AutoPlay). |
| KB5131087 | Windows 11 23H2 | Security-only cumulative update. Same security fixes, fewer feature additions. |
| KB5131096 | Windows 10 (Extended Security) | Extended security update for Windows 10 machines still in service. |
| KB5131080 | Windows Server 2019 | Includes the Exchange sign-in fix (see below). |
| KB5131090 | Windows Server 2016 | Includes the Exchange sign-in fix. |
All updates: Settings → Windows Update → Check for Updates. Don't wait for the overnight auto-run. For servers, schedule a maintenance window this week.
🔢 By the Numbers
November's Patch Tuesday addressed 1,235 vulnerabilities — slightly down from October's record-breaking 1,411, but still massive. The breakdown:
- 66 Critical vulnerabilities — 48 Remote Code Execution (RCE), 15 Elevation of Privilege (EoP), 3 Use-After-Free in Edge
- ~639 Windows-specific flaws across Windows components
- 1 actively exploited zero-day (the Outlook vulnerability above)
- Additional fixes across .NET, Active Directory, ASP.NET Core, Exchange, and Edge
Microsoft continues using AI-assisted vulnerability discovery, which is why these numbers have been running high all year. More flaws found and fixed proactively is a good thing — but it means Patch Tuesday is no longer optional maintenance. It's critical infrastructure hygiene.
✅ Finally Fixed: Exchange Server Sign-In Issues
If you run on-premises Exchange Server and had Outlook sign-in failures or stuck emails after October's updates — this month's patches fix it.
October's Windows Server updates introduced a new default limit on memory that the Endpoint Mapper could use for lookup calls. On busy Exchange servers, this caused Outlook Web Access (OWA) sign-in failures, emails stuck in Outbox, and mailbox replication issues. Not every server was affected — it depended on load — but for those that were, it was a real headache.
November's server updates (KB5131080 for Server 2019, KB5131090 for Server 2016) resolve the underlying issue. If you can't install the updates immediately, Microsoft published a registry workaround that increases the Endpoint Mapper memory limit.
✅ Finally Fixed: USB Audio Issues (Since September)
USB audio devices that stopped working after September's updates are fixed by KB5132061.
Since September, some Windows users have experienced USB Audio Class 1.0 devices failing to produce sound, unresponsive volume controls, and "This device cannot start (Code 10)" errors in Device Manager. Microsoft released a partial out-of-band fix in September for 8-channel and 3D audio modes, but the remaining issues persisted until now. This month's KB5132061 resolves the full set of symptoms on both Windows 10/11 and Windows Server.
🆕 Windows 11 Feature Highlights (KB5132061)
Beyond the security fixes, the Windows 11 26H2/25H2/24H2 update includes some genuinely useful changes:
- Customizable right-click menu — Finally. You can now turn built-in commands on or off, choose which app extensions appear, and display Cut/Copy/Paste as text instead of icons. Right-click → "Customize menu" to set it up.
- File Explorer improvements — Search results now show file info in a consistent layout. The address bar supports
~for quick navigation to your user profile folder. Dark mode for Folder Options. - Modernized AutoPlay — The dialog for connected devices now supports dark mode and better text scaling.
- Magnifier upgrades — Per-monitor zoom for multi-display setups, contrast theme toggle, and viewport locking.
⚠️ Also on Your Radar This Week
- Barracuda ESG — CISA deadline is Thursday, November 13. Two chained vulnerabilities (authentication bypass + root command injection) are being actively exploited. If you run Barracuda email appliances, patch today and review logs for signs of prior compromise. CISA flagged these as requiring forensic triage — unusual language that means "check if they were already inside." (CISA KEV Catalog)
- SonicWall SSL-VPN — CISA deadline is November 20. The MFA bypass vulnerability is confirmed exploited in the wild. If you haven't patched yet, 9 days remain. (Our coverage)
- N-able N-central RMM — 30+ zero-days published. N-able took its cloud platform offline after a security researcher publicly dropped over 30 vulnerabilities. If your IT provider uses N-able's remote management platform, ask them about their response. (BleepingComputer)
Today's Action Items
- Install November cumulative updates on all Windows machines and servers — the Outlook zero-day is actively exploited
- Restart after updating — patches aren't active until the system reboots
- Exchange Server admins: Install KB5131080 (2019) or KB5131090 (2016) to fix October's sign-in issues
- USB audio problems? KB5132061 finally resolves the September regression
- Barracuda ESG customers: CISA deadline is Thursday — patch and review logs today
- SonicWall customers: 9 days to the November 20 CISA deadline
Sources: BleepingComputer — Patch Tuesday Overview · BleepingComputer — KB5132061 Details · BleepingComputer — Exchange Fix · BleepingComputer — USB Audio Fix · Microsoft MSRC · CISA KEV Catalog