If your November Office rollout is still in progress, add OneNote to the build check. Microsoft published CVE-2026-126526 on November 11, 2026 at 12:00 UTC and says its November 10 updates already contain the fix.
What changed
The CVE was missing from the initial Security Update Guide release. A user must open a crafted OneNote file and convert its ink to text. Code can then run with that user’s permissions.
Vendor rating Important, CVSS 3.1 8.8. Microsoft reports no known exploitation or public disclosure and rates exploitation Less Likely. The CVE is absent from CISA KEV. Suggested MSP priority Verify this in the November Office rollout, starting with users who receive external notebooks. Last verified November 12, 2026 UTC.
Verify the installed Office build
Windows Office LTSC, 32- and 64-bit Use 16.0.14334.21048 for LTSC 2021 or 16.0.17932.21140 for LTSC 2024.
Microsoft 365 Apps for enterprise on Windows Match the device’s channel and supported release to Microsoft’s November 10 security build table. Current Channel 2610 is 20527.20196. Monthly Enterprise and Semi-Annual Enterprise have separate builds.
Mac MSRC lists Office 365 for Mac and Office LTSC for Mac 2021 and 2024 with fixed build 16.115.26110837. Confirm the installed edition and servicing status. MSRC lists the affected editions and fixed builds, with no complete lower build boundary.
Rollout and verification
Inventory the desktop OneNote installations, Office channels and builds per customer. Apply the November Office security update for the installed channel through the customer’s managed rollout, then reopen Office and confirm the running build. Microsoft says devices that already installed the November update need no additional action for this CVE. No vendor workaround or compromise-check requirement was verified.
Microsoft CVE advisory · MSRC November CVRF · Office security builds · Office for Mac release notes · CISA KEV