November Patch Tuesday 2026: The Outlook Spoofing Flaw and Chrome Zero-Day Your Business Cannot Ignore
Two vulnerabilities confirmed as actively exploited in the wild. Both affect software running on virtually every UK small business computer. Both have patches available right now.
This is not a drill, and it is not vendor marketing. The United States Cybersecurity and Infrastructure Security Agency (CISA) added both to its Known Exploited Vulnerabilities (KEV) catalogue on the 10th of November 2026, the same day Microsoft released its November Patch Tuesday updates. That timing is significant: it means attackers are exploiting these flaws in real environments, not just in research papers.
Here is what matters, in order of urgency.
Story One: Microsoft Outlook Is Being Used to Spoof Trusted Senders Right Now
CVE-2026-124194 is a spoofing vulnerability in Microsoft Office Outlook. The technical description is dry: a “missing user interaction for potentially unsafe action” flaw. The practical implication is not dry at all.
An attacker who exploits this flaw can make an email appear to come from a trusted sender. A supplier. A solicitor. A member of your own staff. The spoofing happens over the network. No physical access required.
For a UK small business, that is a phishing attack on a silver platter. Your staff already receive emails that look legitimate. This vulnerability makes the deception measurably easier to execute and measurably harder for your people to detect.
CISA’s required action is unambiguous: apply the vendor’s mitigations. Microsoft released a patch as part of November’s Patch Tuesday update cycle. If your systems are set to automatic updates, you may already be protected. If they are not, or if you are unsure, that uncertainty is itself a problem worth addressing today.
The fix is not complicated. Open Windows Update, check for updates, install them. If you have an MSP or IT support provider managing your systems, contact them this week and ask specifically whether CVE-2026-124194 has been patched across your estate. Ask for confirmation in writing.
If your IT provider cannot tell you whether a confirmed, actively-exploited vulnerability affecting Microsoft Outlook has been patched, that is information you need.
Story Two: Chrome Has Now Had Eight Actively Exploited Zero-Days in 2026
CVE-2026-125350 is a use-after-free vulnerability in Google Chrome’s XML component. Use-after-free is a class of memory corruption flaw: software continues to use a section of memory after it has been released, and an attacker can manipulate that behaviour to execute arbitrary code inside the browser’s sandbox.
In plain terms: visiting a specifically crafted webpage could allow an attacker to run code on your machine through Chrome. CISA added this to the KEV catalogue on the 10th of November 2026, confirming active exploitation in the wild.
This is Chrome’s eighth actively exploited zero-day of 2026. The number is not a reason to panic. It is a reason to have a clear, repeatable process for keeping browsers updated. Chrome’s auto-update mechanism works, but it requires the browser to be restarted to apply updates. Many users leave Chrome open for days or weeks without restarting. The update sits downloaded but unapplied.
The check takes thirty seconds: open Chrome, go to the three-dot menu in the top right, select Help, then About Google Chrome. If an update is available, it will appear there. If the browser shows a coloured update indicator in the top right corner, that is the same signal. Close and reopen Chrome to apply it.
Microsoft Edge and Opera are also based on the Chromium engine. The KEV entry notes that this vulnerability could affect multiple web browsers that utilise Chromium. If your staff use Edge or Opera, those browsers require the same attention.
What Else Arrived This Patch Tuesday
The Outlook and Chrome flaws are the two items most relevant to UK small businesses because they affect near-universal software. But November’s Patch Tuesday arrived with a significant volume of additional critical vulnerabilities, and two categories are worth noting for context.
Adobe Connect received a substantial number of critical vulnerability disclosures on the 10th of November 2026, including multiple flaws rated CVSS 10.0: the maximum possible severity score. These include path traversal vulnerabilities allowing arbitrary file system reads, SQL injection flaws allowing arbitrary code execution, and an incorrect authorisation vulnerability resulting in privilege escalation. If your business uses Adobe Connect for video conferencing or webinars, check with your IT support whether updates have been applied. If you are unsure whether you use it, the question is worth asking.
Microsoft SharePoint also received attention, with CVE-2026-120002 (CVSS 9.9) for privilege escalation and CVE-2026-80095 (CVSS 9.0) for cross-site scripting enabling privilege escalation. SharePoint is used by many small businesses as a document storage and collaboration platform, often delivered through Microsoft 365. If your business uses SharePoint, your Microsoft 365 subscription should handle updates automatically, but confirming this with your IT provider is a reasonable step.
The Barracuda Networks entries in this month’s KEV catalogue are worth flagging separately for businesses that use Barracuda security appliances: CVE-2026-116606 and CVE-2026-111560 are chainable vulnerabilities affecting the Email Security Gateway, Load Balancer, Web Application Firewall, and several other Barracuda products. CVE-2026-116606 allows an unauthenticated remote attacker to restore a crafted backup archive and modify the appliance’s global configuration. Chained with CVE-2026-111560, which allows OS command injection with root privileges, this is a serious combination. If Barracuda appliances sit in your network or your MSP’s network, escalate this today.
The Backup Software Vector: AhsayCBS
Separate from the Patch Tuesday news, Huntress researchers disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS, a backup management product used by some MSPs to manage client backups. Attackers chained the flaws to deploy web shells, cryptocurrency miners, and a Python-based backdoor that persisted on affected systems.
This is relevant to UK small businesses for one specific reason: your backup solution is a target. Attackers understand that backup software typically runs with elevated privileges and has access to sensitive data across the systems it protects. If your MSP uses AhsayCBS, ask whether it has been updated and whether the systems it manages were affected. If your MSP cannot answer that question promptly and clearly, that is diagnostic information about your MSP.
Why the Data Pattern on Chrome Matters
Eight actively exploited Chrome zero-days in a single calendar year is a signal worth examining. The browser is the primary attack surface for most office-based workers. It is the application through which staff access cloud services, receive documents, process invoices, and communicate with clients. Treating browser updates as optional or low-priority is a category error.
The NCSC’s guidance on browser security is clear: use a supported browser and keep it updated. Chrome’s update mechanism is capable; the failure point is usually the restart requirement. Building a simple habit of restarting Chrome at the start of the working day eliminates that gap at zero cost.
Why This Gives You an Edge
Most of your competitors are not reading CISA’s KEV catalogue. Most of them do not know that Microsoft Outlook had a spoofing vulnerability confirmed as actively exploited on the 10th of November 2026. They will find out when something goes wrong.
You now know. That gap is an advantage, but only if you act on it.
If you work with clients in regulated sectors, in legal, financial services, healthcare, or public sector supply chains, your ability to demonstrate that you identify and respond to confirmed exploited vulnerabilities is a credible differentiator in procurement conversations. It is also increasingly relevant to cyber insurance underwriting, where insurers are asking more precise questions about patch management cadence.
The question “how quickly do you apply patches for vulnerabilities confirmed as actively exploited?” has a right answer. It is “within days, not weeks, and we have a process to confirm this.”
Making the Business Case
If you need to have a conversation with a director or budget holder about why patching deserves attention and resource, here are three arguments grounded in this week’s data:
First, the regulator has a view. The ICO has taken enforcement action against organisations where unpatched known vulnerabilities contributed to data breaches. A confirmed, actively-exploited vulnerability with a patch available is a known vulnerability. Failing to apply it is a documentable choice. The ICO’s breach notification requirements and enforcement history make this a board-level risk, not an IT department footnote.
Second, the threat is not theoretical. CISA’s KEV catalogue exists specifically to distinguish confirmed in-the-wild exploitation from theoretical risk. Both CVE-2026-124194 and CVE-2026-125350 are confirmed exploited. The question is not whether attackers are using these flaws; it is whether your systems are still vulnerable when they do.
Third, the cost asymmetry is stark. A ransomware recovery, including IT costs, lost productivity, potential regulatory notification, and reputational damage, routinely costs UK small businesses tens of thousands of pounds. The cost of applying this month’s patches is a conversation with your IT provider and an hour of update windows. These are not comparable costs.
What to Do Before the End of This Week
-
Apply Microsoft’s November 2026 patches. Open Windows Update on any Windows device in your business. Install all available updates. If you have an MSP, contact them today and ask for written confirmation that November patches have been applied across your estate, specifically referencing CVE-2026-124194.
-
Check and restart Chrome. On every machine that uses Google Chrome, go to the three-dot menu, select Help, then About Google Chrome. If an update is shown, apply it. Restart the browser. Repeat this for Microsoft Edge and Opera if used.
-
Ask your MSP about Barracuda. If your network includes any Barracuda appliances, ask specifically about CVE-2026-116606 and CVE-2026-111560. These are chainable vulnerabilities allowing unauthenticated remote configuration modification. If Barracuda is in your supply chain via your MSP, the question is still relevant.
-
Ask your MSP about AhsayCBS. If you do not know what backup software your MSP uses to manage your systems, this week is a reasonable time to ask. If the answer is AhsayCBS, ask whether it is fully updated and whether any systems showed indicators of the backdoor described in the Huntress research.
-
Confirm your patch management process in writing. If you do not currently receive regular written confirmation that security patches have been applied, ask for it. A monthly email confirming patch status is a basic accountability mechanism. If your IT provider will not provide it, that tells you something.
The data from this week is clear. Two actively exploited vulnerabilities affecting near-universal software. Patches available. Action required.
That is the brief. The rest is execution.
Before you go: follow the show wherever you listen, and if this briefing was useful, leave a rating or a review. It genuinely helps others find the podcast. Drop a comment with your thoughts, and if you know someone running a small business who should be across this, share it with them.