Microsoft's November 2026 Patch Tuesday fixes 1,259 flaws including exploited Outlook zero-day

Microsoft's November 2026 Patch Tuesday arrived on November 10 with fixes for 1,259 vulnerabilities, the second consecutive month the monthly release has crossed the 1,000-CVE mark. The item demanding immediate attention is CVE-2026-124194, an Outlook vulnerability that Microsoft says is already being exploited in the wild. According to dev.to, republishing analysis from RedEye Threat Intelligence, CISA placed the flaw in its Known Exploited Vulnerabilities catalog the same day, giving US federal agencies a remediation deadline of November 24, 2026.

An Outlook flaw that suppresses the warning

Microsoft rates CVE-2026-124194 as Moderate severity with a CVSS score of 6.5 and classifies it as spoofing. The advisory traces the root cause to a product interface that fails to caution users before unsafe actions.

In practice, an unauthenticated attacker emails a specially crafted message file and persuades the recipient to open it in an affected Outlook build. Outlook then connects to a network location the attacker controls while skipping the external-content warning that would ordinarily flag or block that connection. The outbound connection carries authentication material, including the user's NTLMv2 hash. Exploitation requires only network connectivity and a single user action. Microsoft credited the discovery to a researcher known as Nono and to Benoît Sevens of Anthropic, who used Claude in the process.

What a leaked NTLMv2 hash enables

A stolen hash is an identity, not just mailbox data. Attackers can attempt offline cracking of weak or reused passwords, relay the authentication to internal services that still accept NTLM and act as the victim without ever knowing the password, or use the account for lateral movement into whatever it can reach. Jack Bicer, director of vulnerability research at Action1, summarized the risk: "Email is the easiest door into any company, and this flaw turns one opened file into a stolen identity." He also argued that the Moderate label undersells the bug, given the combination of active exploitation, minimal user interaction and Outlook's near-universal presence in enterprises. The blast radius scales with the privileges of whoever opens the file: a compromised IT administrator is a very different incident than a single sales mailbox.

The rest of the release

The 1,259 fixes break down as 726 Windows flaws, 174 in Office, 59 in SQL Server, 27 in SharePoint Server, dozens in developer tools and 165 identifiers issued by third parties. Elevation of privilege bugs account for more than 500 of the total, ahead of remote code execution and information disclosure. Satnam Narang of Tenable calculates that Microsoft has now addressed more than 5,100 CVEs in 2026.

Microsoft has not reported exploitation for any of the following, but several sit in core infrastructure: CVE-2026-116928 (remote code execution in Windows Search), CVE-2026-119958 (RCE in LDAP, relevant to every domain controller), CVE-2026-119952 (RCE in Schannel, the Windows TLS stack), CVE-2026-95962 (RCE in the Windows Virtual Filtering Platform), CVE-2026-112967 (RCE in the Xbox Live Networking Service) and CVE-2026-119990 (elevation of privilege in Azure OpenAI).

What remains unknown

Microsoft has not attributed the in-the-wild activity to any threat actor and has published no technical detail on how attackers are delivering or weaponizing the flaw, and it is unclear whether the researchers found the bug before or after exploitation began. Defenders are therefore left without vendor-supplied indicators of compromise, lure samples or infrastructure to hunt for. Detection currently depends on generic signals, such as outbound NTLM authentication headed toward external hosts, rather than a known campaign signature.

Prioritizing under volume

Jake Knott, head of threat intelligence at watchTowr, notes that most teams have not recovered from recent months of bumper vulnerability releases and are struggling to sort out what actually matters. His recommended order: internet-exposed assets first, then flaws already exploited in the wild, then everything else after confirming the vulnerable component is present and exploitation prerequisites are met. The dev.to analysis adds a subtler hazard: in a release with 1,259 entries, a 6.5 Moderate is easy to filter out of a dashboard sorted by CVSS, yet attackers pick whichever flaw yields credentials with the least friction.

Why it matters

CVE-2026-124194 turns routine email into a credential theft channel requiring a single user action, and the resulting NTLMv2 hash can carry an attacker well beyond the inbox into file shares, internal applications and administrative systems. A Moderate CVSS rating is a poor triage signal for a flaw that is confirmed exploited and deployed on nearly every enterprise endpoint. With two straight months above 1,000 CVEs, patch volume itself has become an operational risk, and the divide between actively exploited bugs and everything else is the line defenders should draw first.