Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes - The Hacker News
Microsoft released patches for 1,259 vulnerabilities across its software portfolio on Tuesday, including an actively exploited Outlook flaw that may expose NTLMv2 hashes.
These patches cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The updates also include 165 non-Microsoft-issued CVE identifiers. More than 500 flaws relate to elevation of privilege, followed by remote code execution and information disclosure bugs.
Outlook Vulnerability
A Moderate-severity security flaw in Microsoft Outlook (CVE-2026-124194, CVSS score: 6.5) has been flagged as actively exploited. The vulnerability allows an unauthenticated attacker to send a specially crafted message file that, when opened, could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning.
This could potentially disclose authentication information, such as an NTLMv2 hash, that could be used to impersonate the user. Microsoft emphasized that successful exploitation requires network connectivity and user interaction.
Other Vulnerabilities
The patches also address several remote code execution flaws affecting Windows Search (CVE-2026-116928), Lightweight Directory Access Protocol (CVE-2026-119958), Windows Schannel (CVE-2026-119952), Windows Virtual Filtering Platform (CVE-2026-95962), and Windows Xbox Live Networking Service (CVE-2026-112967), as well as a privilege escalation flaw in Azure OpenAI (CVE-2026-119990).
Teams are really starting to feel the strain of working out 'what actually matters?' when there is fire after fire every day demanding immediate attention. Start with what you actually have exposed to the Internet, then what's already being exploited in the wild, and only then everything else.
The U.S. Cybersecurity and Infrastructure Security Agency has added the Outlook vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply the fix by November 24, 2026.
Related
