Patch Tuesday

CISA KEV

CVE-2026-124194: Outlook Spoofing Flaw Exploited as a Zero-Day, Added to CISA KEV

Microsoft fixed an exploited Outlook flaw on November 10, 2026. Opening a crafted message file can make Outlook skip its external-content warning and leak an NTLMv2 hash. CISA added it to KEV the same day, due November 24. This post lists fixed builds and what to check.

Patch Tuesday

October 2026 Patch Tuesday: A Record Release and One Exploited Windows Shell Bug

Microsoft's October 2026 Patch Tuesday is the largest ever, with roughly 1,400 fixes. One Windows Shell flaw, CVE-2026-96951, was exploited and has an October 16 CISA deadline. Here is what to patch first.