# Patch Week Kit: Outlook Zero-Day and Credential-Theft Defense

**Purpose.** This kit helps a small business handle November 2026's Microsoft updates without testing all 1,094 fixes. It covers patching Windows and Outlook in two waves, blocking outbound SMB so a stolen Windows credential hash cannot phone home, checking whether you run any of the four CISA-listed exploited products (OpenSSH, IBM Aspera Faspex, SignalWire FreeSwitch, GPUStack), locking down cloud and AI keys, and knowing when to switch to emergency mode. Print it, fill it in, and keep it with your IT notes. Confirm all facts against the linked sources at the end.

## Checklist

- [ ] Run Windows Update on every PC, including laptops that are at home or traveling.
- [ ] Run the Microsoft 365 Apps update on every PC and confirm Outlook's build number changed.
- [ ] Restart every machine after patching. Note any PC that has not restarted in weeks.
- [ ] Ask whoever manages the firewall to confirm outbound SMB (TCP 445) is blocked, in writing.
- [ ] Get a one-line yes or no, from your IT provider or your own check, on OpenSSH, IBM Aspera Faspex, SignalWire FreeSwitch and GPUStack.
- [ ] If OpenSSH is reachable from the internet: patch it, limit access by IP address or VPN, and disable password login in favour of keys.
- [ ] Patch internet-facing software in wave one, not wave two.
- [ ] Send the staff warning notice below.
- [ ] Rotate cloud and AI API keys, set a hard monthly spend cap, and turn on usage alerts.
- [ ] Check whether you use Railway, and review recent billing for unexpected charges.
- [ ] Put the watch-list triggers below on a recurring reminder for the next two weeks.

## Worksheet 1: Two-wave patch tracker

Wave one: Outlook, Windows, internet-facing software. Wave two: everything else on your normal cycle.

| Device / user | Location (office, home, travel) | Windows updated (date) | M365 Apps updated (date) | Outlook build after update | Restarted (date) | Wave | Done by |
|---|---|---|---|---|---|---|---|
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |

Time budget: number of PCs ____ x minutes per PC ____ = total minutes ____. (A rough planning figure is 20 minutes per PC.)

## Worksheet 2: Firewall and network

| Question | Answer | Confirmed by (name, date) |
|---|---|---|
| Is outbound SMB (TCP 445) blocked at the firewall? | | |
| Which internet-facing services do we run (SSH, remote desktop, file transfer, VPN)? | | |
| For each: is access limited to specific IP addresses or a VPN? | | |
| Is SSH password login disabled in favour of keys? | | |
| Who has admin access to the router or firewall? | | |

## Worksheet 3: CISA-listed software inventory

| Product | CVE | Do we run it? (yes / no / unsure) | Owner | Installed version | Exposed to internet? | Patched on (date) |
|---|---|---|---|---|---|---|
| OpenSSH | CVE-2026-123158 | | | | | |
| IBM Aspera Faspex | CVE-2026-123218 | | | | | |
| SignalWire FreeSwitch | CVE-2026-116779 | | | | | |
| GPUStack | CVE-2026-102895 | | | | | |

Remember to look at NAS boxes, remote-support servers and anything a vendor installed for you.

## Worksheet 4: API key and spend-cap checklist

| Service | Key location | Rotated (date) | Monthly spend cap ($) | Usage alert on? | Last billing review (date) |
|---|---|---|---|---|---|
| | | | | | |
| | | | | | |
| | | | | | |

Rule of thumb: pick a cap you could lose entirely without a crisis. A $200 cap limits a stolen key to $200.

## What to watch and what to do

| Trigger | Action |
|---|---|
| Public proof-of-concept code appears for CVE-2026-124194 | Confirm every PC is patched and restarted within 24 hours; verify the SMB block again. |
| Reports of attributed campaigns using the Outlook flaw | Brief staff again; ask IT to review recent sign-in and mail activity. |
| Any of the four CISA entries gets a ransomware-use flag | Treat as emergency: patch or isolate the product the same day. |
| Railway or your own vendor reports credential exposure | Rotate every key and service credential tied to that vendor immediately. |

## Template: Email to your IT provider

```text
Subject: Written confirmation needed by end of day: patch status and exposure

Hi [name],

Please confirm in writing by end of day:

1. Outlook and Windows patch status on every device (list any that are not updated or not restarted).
2. Whether outbound SMB (TCP 445) is blocked at our firewall.
3. Whether we run OpenSSH, IBM Aspera Faspex, SignalWire FreeSwitch or GPUStack anywhere, with the installed version of each and whether it is reachable from the internet.
4. If OpenSSH is exposed, whether access can be limited to specific IP addresses and password login turned off.

Thanks,
[your name]
```

## Template: Staff notice

```text
Subject: Be careful with email this week

Microsoft released a large set of security fixes, including one for an Outlook problem that criminals are already using. Please update your computer when asked and restart it.

This week, be cautious with unexpected emails, calendar invites and links to shared-drive paths. Do not click or open anything that looks odd.

If something looks off, do not reply. Tell [name / contact] right away. Reporting a mistake early is always better than hiding it.
```

## Prompts to paste into an AI assistant

Always paste in your own documents or data, and keep the instruction to say when it is unsure.

```text
I run a business with [number] Windows PCs and Microsoft 365 with desktop Outlook. Using only the device list and notes I paste below, write a one-page plain-English patch plan in two waves (wave one: Outlook, Windows, internet-facing software; wave two: everything else), with who does what, how to verify updates, and how to handle off-site laptops. List any gaps in my notes instead of guessing.

[paste device list and notes]
```

```text
Explain in plain English what it means that an Outlook flaw can leak hashed NTLM credentials, why a medium CVSS score can still be dangerous, and how patching, blocking outbound SMB, and strong unique passwords with MFA reduce the damage for a company of [number] employees. Use the network description I paste below and say where you are unsure.

[paste network description]
```

## Sources

- https://apprised.news/desk/tech/2026-11-11
- https://www.tenable.com/blog/microsoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194
- https://www.securityweek.com/exploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft/
- https://www.csoonline.com/article/4247015/november-2026-patch-tuesday-63-critical-microsoft-fixes-plus-an-outlook-zero-day-that-allows-theft-of-hashed-credentials.html
- https://www.rapid7.com/blog/post/em-patch-tuesday-november-2026
- https://securityaffairs.com/202813/hacking/u-s-cisa-adds-ibm-signalwire-freeswitch-openssh-and-gpustack-flaws-to-its-known-exploited-vulnerabilities-catalog.html
- https://www.bleepingcomputer.com/news/apple/railway-breach-leads-to-740-000-in-fraudulent-ai-charges/