Microsoft’s November 2026 Patch fixes 1.094 vulnerabilities, including exploited Outlook zero-day - Digital Watch Observatory
Microsoft released its November 2026 Patch security updates on 10 November, addressing 1,094 vulnerabilities across its software portfolio, including an Outlook zero-day that had already been exploited in the wild.
The scale of the update follows October's exceptionally large release, which addressed more than 1,400 vulnerabilities. Although November's total is lower, it represents a second consecutive month in which Microsoft has issued more than 1,000 fixes. Published totals vary between security trackers because of differences in scope and counting methodology, particularly in the treatment of Microsoft Edge vulnerabilities and updates released earlier in the month.
Outlook zero-day vulnerability
The most significant vulnerability in the November release is CVE-2026-124194, a spoofing flaw in Microsoft Outlook that can expose a user's NTLMv2 authentication hash. According to Microsoft, an unauthenticated attacker can send a specially crafted message file and persuade a recipient to open it in an affected version of Outlook.
The application may then connect to an attacker-controlled network location without displaying the usual warning about external content, potentially disclosing authentication information.
Critical vulnerabilities
The flaw requires user interaction to be exploited, as opening the malicious file is necessary while the Preview Pane alone does not trigger the attack. The captured NTLMv2 hash could subsequently be used in attempts to impersonate the victim, facilitate authentication to other services or support offline password-cracking attempts.
On 10 November, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-124194 to its Known Exploited Vulnerabilities catalogue, requiring US federal civilian agencies to address it by 24 November. Japan's JPCERT/CC also issued an alert advising organisations to apply Microsoft's security updates.
Other critical fixes
Beyond the Outlook zero-day, the November release addresses 63 vulnerabilities rated Critical, including 48 remote code execution flaws and 15 elevation-of-privilege vulnerabilities. Particular attention is warranted for CVE-2026-116928, affecting the Windows Search component, and CVE-2026-119958, affecting Windows LDAP. Both carry CVSS scores of 9.8 and can reportedly be exploited remotely without user interaction.
Related
