Rated Moderate, Already Exploited: The November Outlook Fix Health Care IT Should Install First

Microsoft's November 10, 2026 updates fix 1,094 of its own CVEs. The only one Microsoft says attackers are already using is a Moderate Outlook flaw that can hand over a user's NTLMv2 hash. The Critical bug in the same release that worries Exchange admins most is fixed by the Windows update on the Exchange server, not by the Exchange update.

If your vulnerability queue sorts by CVSS score, the most urgent fix in this month's Microsoft release is probably sitting somewhere near the bottom of it.

Microsoft's November 2026 Security Update Guide release notes list 1,094 Microsoft CVEs, with 726 of them in Windows alone. Dozens carry Critical ratings, several of them with CVSS scores of 9.8. Exactly one is marked Exploitation Detected, and it is CVE-2026-124194, a Microsoft Outlook spoofing vulnerability rated Moderate with a CVSS base score of 6.5. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal civilian remediation deadline of November 24, 2026.

You will see other totals in other write-ups. BleepingComputer's 1,235 includes Microsoft Edge (Chromium) fixes, and Rapid7 counts 1,092. The differences come from what each outlet counts, and none of them change the point. Out of more than a thousand fixes, the one under active attack is the one a severity filter is most likely to skip.

This article covers what that Outlook flaw actually does, why a hash leak matters more in a hospital or clinic than the word "spoofing" suggests, the Critical Exchange-adjacent bug that is easy to patch in the wrong place, and the order to do the work in.

What Microsoft says the Outlook flaw does

Microsoft's description is short, and it is worth reading closely rather than paraphrasing loosely. According to the advisory, an unauthenticated attacker sends a specially crafted message file and convinces a user to open it in an affected version of Outlook. Opening the file causes Outlook to connect to an attacker-controlled network location without showing the usual external-content warning. Microsoft says that connection "discloses a user's NTLMv2 hash to the attacker," which the attacker could use to authenticate as that user.

A few details matter for how you respond.

The user has to open the file. Microsoft says the Preview Pane is not an attack vector, as SecurityWeek reported from the advisory. That is good news, but do not stretch it into "reading mail is safe." It means the documented attack is opening the crafted file, not previewing it.

The weakness is a missing warning. The CVE record classifies it as CWE-356, Product UI Does Not Warn User of Unsafe Actions. Any user training that boils down to "Outlook will warn you before it connects somewhere" is exactly the thing this bug defeats.

Microsoft has not said who is exploiting it, against whom, since when, or at what scale. It has not said which protocol carries the outbound connection, and it has not published a workaround. You will find write-ups and a public proof-of-concept repository that model the attack on 2023's CVE-2023-23397 reminder-path bug. The author of that repository states it was not tested against a vulnerable Outlook. Treat any specific mechanism you read about as informed speculation until Microsoft says otherwise.

No sourced reporting so far ties the exploitation to health care specifically. That absence is not evidence either way.

Which Outlook is in scope

Microsoft's affected-product list, as published in the NVD record, names three products: Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, in both 32-bit and 64-bit. This is classic Outlook for Windows. The new Outlook for Windows, Outlook for Mac, Outlook on the web, and mobile Outlook are not on the list. That is not the same as Microsoft saying they are immune, but it is where the published scope sits today.

Microsoft 365 Apps for business is not named in the list, but it runs on the same update channels and builds as the enterprise SKU, and the Office security release notes list CVE-2026-124194 in the November 10 section that covers business, enterprise, and retail editions. Do not try to win an argument about SKU names. Check the build.

The November 10 builds that include the fix are:

The most important operational fact in this whole story is the next one. This is an Office update. Installing the November Windows cumulative update does not fix it. A standalone WSUS approval of the Windows cumulative update does not touch Click-to-Run Office. If your patch report says "Windows is current," that report tells you nothing about this CVE.

The Office 2021 problem

Office LTSC 2021 and Office 2021 retail reached end of support on October 13, 2026. Microsoft's lifecycle page says that after that date it no longer provides security updates. Yet the November 10 release notes still list a fixed LTSC 2021 build, and the NVD record still shows 16.0.14334.21048 as the fixed version. Office 2019, which left support on October 14, 2025, also still appears in the November release notes with a volume-licensed build, even though it is not on the CVE's affected list.

Those documents have not been reconciled publicly. The practical answer is to check whether the fixed build actually landed on your LTSC 2021 machines, and to treat any LTSC 2021, Office 2021, or Office 2019 seat as a migration item regardless. Microsoft's own recommendation is Microsoft 365 Apps or, for organizations not ready for the subscription model, Office LTSC 2024. A practice that bought perpetual Office in 2021 and never revisited it is exactly the environment where a one-time November build, if it arrived at all, will be the last one.

What a hash is worth inside a hospital or clinic

"Spoofing" sounds like a mail-display problem. It is really an identity problem.

A quick technical note first, because this audience will catch it. What Outlook leaks here is the NTLMv2 challenge-response, which Microsoft's advisory calls the NTLMv2 hash. It is not the stored NT hash, and an attacker cannot simply replay it next week the way pass-the-hash works with an NT hash. Rapid7's Patch Tuesday analysis describes the two things an attacker can do with it. They can relay it in real time to a service that still accepts NTLM without SMB signing, LDAP signing, or Extended Protection for Authentication (EPA) on Exchange or Active Directory Certificate Services (AD CS). Or they can crack it offline to recover the password, which works if the password is weak. Rapid7's Adam Barnett put it plainly: the 6.5 score "does not tell the full story here."

Now map that to a typical small health care environment.

The account that opens mail is usually the same account that can reach file shares with scanned documents, billing exports, imaging drop folders, and EHR interface directories. Plenty of those shares, and plenty of older clinical and business applications, still accept NTLM. A relayed authentication lets an attacker act as a nurse, a biller, or a help desk technician against those systems without knowing the password.

MFA does not close this gap by itself. Conditional Access and MFA protect interactive sign-ins to Entra ID. NTLM authentication to an on-premises file server or application never passes through that prompt. That is general NTLM behavior, not something Microsoft's advisory states, but it is why "we have MFA" is not an answer to this CVE.

Shared and generic clinical accounts make it worse. If a nursing station login is used by a dozen people and opens mail, a captured credential for that account is both harder to attribute and more broadly useful.

Picture a 25-bed Critical Access Hospital with two rural health clinics, one on-premises file server holding scanned referrals and billing exports. A registration clerk opens a message file that looks like a referral packet. Nothing visible happens. If that clerk's NTLM authentication is relayed to the file server before anyone notices, the attacker reads the share as the clerk. If the clerk's password is short, offline cracking turns a single event into a reusable credential.

Laptops are the other gap. An outbound block on SMB at the hospital firewall does nothing for a clinician who opens a message file on home Wi-Fi or at a rural health clinic with its own internet connection. The Office update has to reach those devices, including the ones that only check in when someone is on site.

The Critical bug that does not wait for anyone to open anything

The same release fixes CVE-2026-116928, a Windows Search remote code execution vulnerability rated Critical with a CVSS score of 9.8. Microsoft's advisory describes the attack as an email with a specially crafted attachment sent to a Microsoft Exchange Server. Exchange processes the attachment for indexing automatically, so the recipient never has to open the message or the attachment. Successful exploitation runs code with the permissions of the affected processing service.

Microsoft rates this one Exploitation Less Likely and has not reported active exploitation. It is not in the KEV catalog. It still deserves attention, because the attack path needs no user at all. Dustin Childs of the Zero Day Initiative called it "a zero-click code execution bug on a high-value target." Microsoft's advisory does not specify the privilege level beyond "the affected processing service." Rapid7 advises assuming SYSTEM because several Exchange services run elevated, which is a reasonable planning assumption but is Rapid7's analysis, not Microsoft's statement.

Here is the trap. The fix for CVE-2026-116928 is in the November Windows cumulative update for the server's operating system. It is not in the Exchange security update. If your team installs the Exchange SU on the mail server and holds the Windows update for the normal server ring, the Critical bug stays open.

For reference, the November 10 Windows cumulative updates include KB5131090 for Windows Server 2022, KB5131080 for Windows Server 2025, and KB5131085 for Windows Server 2019. Confirm the exact KB for each of your Exchange servers in the Security Update Guide before you schedule the window.

There is a second reason not to hold that Windows update on Exchange servers. The October 2026 Windows Server updates introduced a new default memory limit on the RPC Endpoint Mapper that, on some on-premises Exchange servers running Windows Server 2019 or later, caused Outlook on the web (OWA) sign-in failures, messages stuck in Outlook Outboxes, and mailbox replication trouble. BleepingComputer reported that Microsoft says the November updates KB5131080 and KB5131090 fix that regression. If you have been fighting stuck mail since October, the November Windows update addresses a security bug and an operational one at the same time. If you run Exchange on Windows Server 2019, verify on Microsoft's release health page that your build is covered before assuming the October issue is resolved.

The Exchange update itself

Microsoft also released Security Update 12 for Exchange Server Subscription Edition (KB5133453), which fixes nine separate Exchange CVEs: two remote code execution, four elevation of privilege, two spoofing, and one denial of service. None were publicly disclosed or known to be exploited at release. Install it on every Exchange SE server and on any workstation or server that has the Exchange Management Tools, including the management-only server many hybrid organizations keep on premises. Run the Exchange Server Health Checker afterward, as Microsoft's KB recommends.

Exchange 2016 and 2019 received nothing this month. Exchange partner Messageware notes that November is the first Patch Tuesday after the final Extended Security Update period for those versions ended, and that they should now be treated as permanently vulnerable. The Windows cumulative update can still patch the Windows Search component underneath them, provided the Windows Server version is itself supported. But the Exchange product will not get fixes for this month's nine Exchange CVEs or anything that follows. If you are still receiving mail on Exchange 2016 or 2019, that is a migration project with a deadline that has already passed, not a "we'll catch it next month" patch item.

According to Messageware, Exchange Online is already protected against the issues SU12 fixes. Organizations fully in Exchange Online with no on-premises Exchange server have nothing to patch for KB5133453.

Two more items not to lose in the noise

Domain controllers have their own pre-authentication Critical this month. CVE-2026-119958 is a Windows LDAP remote code execution bug rated 9.8, unauthenticated over the network, with no reported exploitation. ZDI's advice was to test and deploy it quickly. Patch domain controllers one at a time in the same maintenance cycle.

The November Windows updates also begin a change that will matter more than any single CVE over the next six months. Microsoft's KB5135557 describes the first phase of NTLM message signing changes tied to CVE-2026-118737. Starting with these updates, Windows clients offer NTLM signing by default and servers audit clients that do not sign. In phase 2, scheduled for May 2027, Windows servers will require signing by default and reject clients that do not offer it. Kerberos is unaffected, and anonymous and guest connections are exempt.

That change does not fix CVE-2026-124194. It does raise the bar for relaying captured NTLM exchanges against patched Windows servers once enforcement lands, and it gives you an audit trail right now. Medical devices, label printers, older PACS workstations, scanners, and vendor appliances that still speak unsigned NTLM will not break in November. They are on a six-month clock. The audit events are in the Microsoft-Windows-NTLM/Operational log (Event ID 4023 on servers, 4022 on clients) and require NTLM enhanced auditing and Windows Server 2019 or later. Signed and unsigned connections both log at Warning level, so read the negotiated flags, not the event level. Resist setting ClientAllowUnsignedNtlm to 1 as a permanent exception. Microsoft documents it as a temporary compatibility setting and says the registry values may be removed in the future.

What to do this week, in order

The patch order below separates three kinds of work: installing Microsoft's fixes, general identity hardening that limits what a leaked hash is worth, and investigation. Only the first category is a fix for these CVEs.

1. Find every classic Outlook client and its build. Do not infer it from Windows patch compliance. On a single machine, File, then Office Account, shows the version and build. At scale, the Click-to-Run build is in the registry at HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration as VersionToReport. The script below reports each device against the November 10 fixed builds. It writes one status line, which shows up in Configuration Manager's Run Scripts results, and returns an exit code that works as the detection script for an Intune Remediation where your licensing includes it. It uses the lowest fixed build in each version line, so treat an OK result as a first pass and confirm the device's update channel against Microsoft's release notes where it matters. It also flags MSI-based Outlook, which is not on the affected list but is out of support. If you deploy it as an Intune Remediation, set it to run in 64-bit PowerShell. The default 32-bit host is redirected to the 32-bit registry view and can miss the Click-to-Run key.

# Reports Click-to-Run Office build against the November 10, 2026 fixed builds for CVE-2026-124194.
# Also flags MSI-based Outlook 2016/2013, which is out of support (not on the CVE's affected list).
# Exit 0 = at or above a fixed build, or no Outlook found. Exit 1 = needs attention.
# Uses the lowest fixed build in each version line. Confirm channel against Microsoft's release notes.

Function Get-FixedMinimumBuild ($BuildMajor) {
  switch ($BuildMajor) {
    20527 { return 20192 }   # Version 2610 (Current, Monthly Enterprise, Semi-Annual Enterprise)
    20430 { return 20262 }   # Version 2609 (Monthly Enterprise, Semi-Annual Enterprise)
    20326 { return 20318 }   # Version 2608 (Monthly Enterprise, Semi-Annual Enterprise)
    17932 { return 21140 }   # Office LTSC 2024, Version 2408
    14334 { return 21048 }   # Office LTSC 2021, Version 2108 (out of support October 13, 2026)
    default { return $null }
  }
}

$C2RPath = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"

if (Test-Path -Path $C2RPath) {
  $C2RConfig = Get-ItemProperty -Path $C2RPath
  $Version = $C2RConfig.VersionToReport
  $Products = $C2RConfig.ProductReleaseIds

  if ($null -eq $Version) {
    Write-Output "INVESTIGATE: $($env:COMPUTERNAME) has Click-to-Run configuration but no VersionToReport value."
    exit 1
  }

  $Parts = $Version.Split(".")
  $BuildMajor = [int]$Parts[2]
  $BuildMinor = [int]$Parts[3]
  $FixedMinimum = Get-FixedMinimumBuild $BuildMajor

  if ($null -ne $FixedMinimum) {
    if ($BuildMinor -ge $FixedMinimum) {
      Write-Output "OK: $($env:COMPUTERNAME) has $($Products) at $($Version), at or above fixed build $($BuildMajor).$($FixedMinimum)."
      exit 0
    } else {
      Write-Output "UPDATE NEEDED: $($env:COMPUTERNAME) has $($Products) at $($Version), below fixed build $($BuildMajor).$($FixedMinimum)."
      exit 1
    }
  } elseif ($BuildMajor -gt 20527) {
    Write-Output "OK: $($env:COMPUTERNAME) has $($Products) at $($Version), newer than the November 10 builds."
    exit 0
  } else {
    Write-Output "INVESTIGATE: $($env:COMPUTERNAME) has $($Products) at $($Version), a build line not in the November 10 fixed list (unsupported channel version, Office 2019, or a stale client)."
    exit 1
  }
} else {
  # No Click-to-Run Office. Look for MSI-based Outlook 2016 (16.0) or 2013 (15.0), 64-bit and 32-bit.
  $MsiPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Office\16.0\Outlook\InstallRoot",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Outlook\InstallRoot",
    "HKLM:\SOFTWARE\Microsoft\Office\15.0\Outlook\InstallRoot",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\Outlook\InstallRoot"
  )
  $MsiFound = $null

  foreach ($MsiPath in $MsiPaths) {
    if (Test-Path -Path $MsiPath) {
      $MsiFound = $MsiPath
      break
    }
  }

  if ($null -ne $MsiFound) {
    Write-Output "INVESTIGATE: $($env:COMPUTERNAME) has MSI-based Outlook ($($MsiFound)). Not on the CVE-2026-124194 affected list, but out of support."
    exit 1
  } else {
    Write-Output "NO OUTLOOK: $($env:COMPUTERNAME) has no Click-to-Run Office and no MSI-based Outlook 2013 or 2016."
    exit 0
  }
}

2. Push the Office update to every in-support classic Outlook client, including laptops. Use whatever already services Microsoft 365 Apps in your environment. In Configuration Manager, that means the Microsoft 365 Apps/Office 2019/Office LTSC product is synchronized in the software update point, the Office 365 client agent management setting is enabled in client settings, and the November updates are deployed with a short deadline. Intune-managed devices follow their configured update channel and deadline, so confirm the November build is actually rolling and tighten the deadline if needed. Devices that update straight from the Office CDN with no management will get there on their own schedule, which can be days. For a handful of unmanaged machines, "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user starts the update immediately. Automox's Jon Levenson told Forbes that organizations should "push the fix to your endpoints today." CISA's November 24 date binds federal civilian agencies, not private hospitals and clinics, but it is a reasonable outer bound for anyone else, not a reason to wait until then.

3. Find and plan around out-of-support Office. Run the same inventory for Office LTSC 2021, Office 2021 retail, Office 2019, and Office 2016. If the fixed LTSC 2021 build is not landing, the durable answer is moving those seats to Microsoft 365 Apps or Office LTSC 2024, not a compensating control on a client that will not receive another fix.

4. Install the November Windows cumulative update on every on-premises Exchange server. This is the package that closes CVE-2026-116928. Test first, then patch. It is also the reported fix for the October OWA and Outbox regression.

5. Install Exchange SE SU12 (KB5133453) where it applies. Every Exchange SE server and every machine with the Exchange Management Tools. Run the Health Checker afterward. Put Exchange 2016 and 2019 on a migration plan with a date.

6. Patch domain controllers, one at a time. Same maintenance cycle, after the Exchange servers are queued.

7. Reduce what a captured hash can do. These are standing identity controls, not a Microsoft workaround for this CVE, and each one needs testing before enforcement. Require SMB signing. Require LDAP signing and channel binding on domain controllers. Confirm EPA is enabled on Exchange and on AD CS web enrollment. Consider placing high-value accounts (domain admins, EHR interface service owners, backup operators) in the Protected Users group, which blocks NTLM for its members but also changes other sign-in behavior, so pilot it first. Audit outgoing NTLM before you restrict it. A blanket deny will break biomedical devices and vendor shares that still depend on NTLM, and you want to find those in a log, not in a call from the lab.

Blocking outbound TCP 445 to the internet is reasonable general hardening for this class of leak, and many practitioners recommend it. Microsoft has not said this attack uses SMB, though, and has not listed a firewall block as a workaround. A perimeter block also misses NTLM over WebDAV and does nothing for a laptop off the corporate network. Do it, but do not report it to leadership as the fix.

8. Look back, not just forward. The patch closes the hole. It does not undo a disclosure that already happened. A relayed authentication is a live event, so the residual risk from an earlier capture is twofold: whatever a relay already reached, and offline cracking, which comes down to password strength. For the period before the Office build landed, review outbound connections from workstations (and from Outlook.exe specifically, if your EDR records the initiating process) to external hosts over SMB or WebDAV, NTLM authentications to destinations that are not your servers, and unexpected use of privileged or clinical accounts. If you enable outgoing NTLM auditing (the "Restrict NTLM: Outgoing NTLM traffic to remote servers" policy set to Audit all), Event ID 8001 in the NTLM Operational log records the target server for outbound NTLM authentication. Microsoft has not published detection guidance or indicators of compromise for this CVE, so treat any specific query you find elsewhere as general NTLM hunting, not a Microsoft-validated detection. Where an exposed account is high value and its password is not long and unique, reset it.

9. Tell staff one thing. Do not open unexpected message files, including .msg and .eml files that arrive as attachments or sit on a file share. Skip the Preview Pane talk, since Microsoft says it is not the vector. And do not tell anyone the warning will protect them, because the bug is that the warning does not appear.

How to write it down

For covered entities and business associates, this is not just a patch cycle. It is a risk management decision, and the record matters.

The HIPAA Security Rule that applies today is the current rule. The January 2025 proposed overhaul is still a proposal. HHS moved it to "long-term actions" on its regulatory agenda this year, with final action now targeted no earlier than July 2027. Under the current rule, Addressable still does not mean optional. It means you implement the specification, or document why it is not reasonable and appropriate and what equivalent measure you put in place instead.

The sections that map directly to this month's work:

• 45 CFR 164.308(a)(1)(ii)(A) and (B), risk analysis and risk management, both Required. Deciding to delay an exploited, KEV-listed fix because its label says Moderate is a risk management decision. So is choosing to put that Moderate item ahead of unexploited Criticals, and so is the residual risk you accept on out-of-support Office and on devices that still need unsigned NTLM. Section 164.308(a)(1)(ii)(B) is where those decisions live. The documentation standard at 45 CFR 164.316(b)(1) is what puts them in writing: written policies and procedures, plus a written record of any action, activity, or assessment the Security Rule requires to be documented.
• 45 CFR 164.308(a)(1)(ii)(D), information system activity review, Required. The look-back in step 8 is this specification in practice.
• 45 CFR 164.308(a)(5)(ii)(B) and (D), protection from malicious software and password management, both Addressable. Keeping the mail client and server operating systems patched is commonly documented under the first. Resetting high-value passwords after possible exposure falls under the second.
• 45 CFR 164.308(a)(6)(ii), security incident response and reporting, Required. If your review shows a credential left the environment and was used to reach ePHI, this is an incident, and the breach analysis under 45 CFR 164.402 follows. Under that section, an impermissible access to protected health information is presumed to be a breach unless a documented risk assessment shows a low probability of compromise. A possible hash disclosure by itself is a reason to investigate, not an automatic notification.
• 45 CFR 164.312(a)(2)(i), unique user identification, Required. An attacker authenticating as a user breaks the assumption that the ID still identifies the person.
• 45 CFR 164.312(b), audit controls, and 164.312(d), person or entity authentication. Both are standards without separate implementation specifications, which means they simply have to be met. Section 164.312(d) requires procedures to verify that a person seeking access to ePHI "is the one claimed." NTLM relay is precisely a failure of that, and MFA on cloud sign-ins does nothing for it on systems that still accept NTLM.
• 45 CFR 164.316(b)(1) and (b)(2)(i), documentation and its six-year retention, Required.

The record itself does not need to be elaborate. It should say which systems were in the affected build range, when the Office update was deployed and confirmed, which Exchange servers received the Windows update in addition to the Exchange SU, what the look-back found, and what residual risk remains on out-of-support Office and on devices that still depend on NTLM. That is the document an auditor or investigator will ask for, and it is far easier to write this week than to reconstruct next year.

The takeaway

This month's lesson is not new, but it is unusually clean. A Moderate, user-interaction bug with a 6.5 score is the only item in a 1,094-CVE release that Microsoft says attackers are using, and it is fixed by an Office update that your Windows patching does not deliver. Sort by exploitation first, then by score. Check Outlook builds, not Windows compliance. Patch Windows on the Exchange server, not just Exchange. And use the next six months of NTLM signing audits to find the devices that will break in May 2027 before they do.

This article is for informational purposes only and does not constitute legal or compliance advice. Covered entities and business associates should consult qualified legal counsel or compliance professionals before making decisions pertaining to HIPAA or IT infrastructure.

Sources

• Microsoft Security Response Center, November 2026 Security Update Guide release notes
• Microsoft Security Response Center, CVE-2026-124194, Microsoft Outlook Spoofing Vulnerability
• Microsoft Security Response Center, CVE-2026-116928, Windows Search Remote Code Execution Vulnerability
• National Vulnerability Database, CVE-2026-124194
• Microsoft Learn, Release notes for Microsoft Office security updates
• Microsoft Learn, Office LTSC 2021 end of support
• Microsoft Support, KB5133453: Security Update for Exchange Server Subscription Edition RTM SU12
• Microsoft Support, KB5131090: Windows Server 2022 security update, November 10, 2026
• Microsoft Support, KB5135557: NTLM signing security improvements
• CISA, CISA Adds Six Known Exploited Vulnerabilities to Catalog, November 10, 2026
• CISA, Known Exploited Vulnerabilities Catalog
• Rapid7, Patch Tuesday, November 2026
• Zero Day Initiative, The November 2026 Security Update Review
• SecurityWeek, Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
• Forbes, Microsoft Confirms Active Exploitation of New Outlook Zero-Day
• BleepingComputer, Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
• BleepingComputer, Microsoft fixes Exchange sign-ins broken by October Windows Server updates
• Messageware, Patch Tuesday November 2026: Exchange Server Security Updates
• Electronic Code of Federal Regulations, 45 CFR Part 164, Subpart C
• Electronic Code of Federal Regulations, 45 CFR Part 164, Subpart D
• Davis Wright Tremaine, HHS Updates Rulemaking Timeframes
• BankInfoSecurity, Feds Delay Planned HIPAA Security Rule Overhaul to Mid-2027