Microsoft Patch Tuesday November 2026, Outlook zero-day exploited, 1,094 flaws fixed - Pasquale Pillitteri
Microsoft's November 2026 Patch Tuesday addressed 1,094 vulnerabilities across its products, with a critical zero-day in Outlook already being exploited in attacks.
Microsoft's November 2026 Patch Tuesday, released on November 10, addresses 1,094 vulnerabilities across its products, with a single zero-day already being exploited in attacks. The most critical flaw is CVE-2026-124194 in Outlook, which leaks the NTLMv2 hash of anyone who opens a tampered message file. Windows accounts for 726 fixes, while Office receives 174 updates.
The total number of vulnerabilities is lower than October's Patch Tuesday, which addressed 1,411 flaws and three zero-days. However, the Outlook zero-day carries particular significance as it's actively being exploited in the wild. Microsoft defines a zero-day as a flaw that was either exploited or made public before a fix existed.
Outlook zero-day details
The Outlook vulnerability works when an attacker sends a crafted message file and convinces a user to open it with a vulnerable version of Outlook. The program then connects to a network resource controlled by the attacker, bypassing the external-content warning that normally appears. This connection causes Windows to authenticate to the remote server, handing over the user's NTLMv2 hash.
With that hash the attacker can impersonate the victim or try to recover the password offline
Microsoft rates the flaw as Moderate with a CVSS of 6.5 (6.2 temporal), as it requires user action and only affects confidentiality. However, CISA has added CVE-2026-124194 to its catalog of known exploited vulnerabilities (KEV) and set November 24 as the deadline for federal civilian agencies to patch it.
Critical vulnerabilities
Among the 1,094 flaws, Zero Day Initiative highlights several critical fixes that should be prioritized. The most severe affects Windows Search through Exchange Server (CVE-2026-116928, CVSS 9.8), where an attacker can send a crafted email that triggers the flaw when the server indexes it automatically, requiring no user action to execute code.
Other critical vulnerabilities include flaws in Windows' LDAP protocol (CVE-2026-119958) that could lead to code execution without credentials, and a remote code execution issue in Schannel (CVE-2026-119952) that Microsoft rates as more likely to be exploited than average. The Xbox Live Networking component also contains a heap overflow vulnerability (CVE-2026-112967, CVSS 9.8) that requires no authentication.
Patch recommendations
For organizations with limited time and resources, experts recommend prioritizing updates for Microsoft 365 Apps and Office LTSC 2021 and 2024 builds, particularly for machines that receive files from outside the organization like accounting and customer support departments.
Exchange Server and domain controller fixes should be installed before workstation updates, as these targets carry the highest potential damage and can be exploited without user interaction. Administrators should also review the known issues in the KB packages before general rollout and test updates on a pilot group first.
Even outside the United States, IT teams should mark CISA's November 24 deadline as a reminder, as timelines in the KEV catalog have become a reference point for security priorities globally. The Outlook zero-day, despite its moderate CVSS score, represents the most urgent threat due to active exploitation.
Related
