Another four-digit Patch Tuesday
Microsoft's November 2026 Patch Tuesday landed on November 10 with updates for roughly 1,100 vulnerabilities across Windows and supported software. Counts differ slightly by source: Tenable tallies 1,093 CVEs and SecurityWeek and The Register report 1,094. Of these, 63 are rated critical, and one is an actively exploited Outlook zero-day.
The zero-day: CVE-2026-124194
CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook, rated moderate with a CVSS score of 6.5.
- An unauthenticated attacker can trick a user into opening a specially crafted message file.
- Outlook may then connect to an attacker-controlled network location without showing its usual external-content warning, which can leak the user's NTLMv2 hash.
- Microsoft reports active exploitation but says the flaw was not publicly disclosed beforehand. No indicators of compromise or technical detail have been shared.
- CISA added it to the KEV catalog on November 10, with a federal remediation deadline of November 24, 2026.
- The fix is delivered through Office updates. Installing the Windows cumulative update alone does not address it.
Leaked NTLMv2 hashes can be cracked offline or relayed to other services, so the moderate score understates the risk in environments that still permit outbound NTLM.
Other areas to prioritize
Coverage highlights a wave of critical bugs in:
- Microsoft Exchange
- SharePoint
- Windows Search
- LDAP
- A CVSS 10.0 flaw in Microsoft Entra, noted in the Tenable analysis
Given the volume, defenders are advised to triage by exposure: internet-facing Exchange and SharePoint first, then domain controllers (LDAP), then the remaining critical fixes.
Recommended actions
- Deploy the Office/Outlook update for CVE-2026-124194 now, separately from the Windows cumulative update.
- Patch internet-facing Exchange and SharePoint servers ahead of the broader rollout.
- Block outbound SMB and NTLM (TCP 445, and restrict NTLM via policy) to limit hash leakage.
- Review Entra tenant guidance for the CVSS 10.0 issue.
- Track the KEV deadline of November 24 if you are subject to federal requirements.