Microsoft has released its November 2026 security updates, addressing more than 1,000 vulnerabilities across Windows, Office, Exchange, SQL Server and other products. The release also fixes an Outlook spoofing flaw that the company says attackers exploited before a patch was available.
The exploited issue, CVE-2026-124194, can expose a user’s NTLMv2 authentication hash when they open a specially crafted message file, an attack path described in a report on the Outlook zero-day’s NTLM hash exposure. Microsoft says an unauthenticated attacker can send the file and cause Outlook to connect to an attacker-controlled network location without showing the usual external-content warning. The attack requires network connectivity and user interaction. Tenable lists the flaw as moderate with a CVSS score of 6.5.
Tenable counted 1,093 CVEs in Microsoft’s November release, with 63 rated critical. The November total is lower than the record October Patch Tuesday, when Microsoft addressed 1,411 vulnerabilities, as detailed in Abijita’s October Patch Tuesday report. BleepingComputer’s broader tally reaches 1,235 when it includes 142 Microsoft Edge Chromium vulnerabilities; that count lists 66 critical flaws, including three Edge use-after-free issues. The two November totals use different counting scopes.
Microsoft’s November security update notes list fixes for Windows 11 and Windows Server, as well as Office, Exchange, Azure, SQL Server, .NET and Visual Studio. The company says the Outlook vulnerability was exploited before the November 10 release in US time. The affected build depends on the product and version in use.
CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10 as part of a six-flaw update based on evidence of active exploitation. Microsoft’s release notice does not identify the attackers or describe the scope of exploitation.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
