Microsoft Fixes 1235 Flaws in Another Record Patch Tuesday - Infosecurity Magazine
Microsoft has issued updates to fix 1235 vulnerabilities in its products, including one zero-day being actively exploited in the wild.
The tech giant's November Patch Tuesday contained fixes for 1235 flaws, making this the fourth month this year Microsoft has set a new record for patches, following previous milestones in July, September and October.
Among the vulnerabilities is CVE-2026-124194, a zero-day spoofing bug in Microsoft Outlook that attackers are actively exploiting to steal NTLM account hashes.
An attacker sends a specially crafted message file and gets the user to open it. Outlook then connects to a network location the attacker controls, but it skips the usual warning about external content.
Outlook vulnerability
The zero-day affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Though rated 'moderate,' Action1's Jack Bicer urges system administrators to prioritize it immediately.
SAP's record patches
Microsoft wasn't the only software giant with record-breaking patches. SAP's November Patch Day addressed 43 vulnerabilities, twice the average for 2026, including four with maximum CVSS scores of 10.0.
These critical flaws include 'ProxyGate' (CVE-2026-89103) and authentication bypass vulnerabilities in SAP NetWeaver. SAP's 'Hot News' notes represent the highest priority security updates.
Related
