Securify

Microsoft’s November 2026 Patch Tuesday, released on November 10, is one for the record books. With 1,094 vulnerabilities addressed across Windows, Office, Exchange Server, SQL Server, Azure, SharePoint, and developer tools, it ranks as the second-largest monthly security release the company has ever shipped — just behind October’s staggering 1,413-flaw update. More urgently, one of the patched bugs is already being exploited in the wild: a spoofing flaw in Microsoft Outlook that silently leaks Windows authentication credentials to attackers.

The Zero-Day: CVE-2026-124194

The headliner of this release is CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook. Despite Microsoft assigning it only a “Moderate” severity rating with a CVSS score of 6.5, the real-world risk is considerably higher. The flaw stems from a missing warning for an unsafe action: when a victim opens a specially crafted message file, Outlook silently connects to an attacker-controlled server without displaying the external-content warning that should flag the outbound request.

That silent connection hands the attacker the user’s NTLMv2 hash — the credential material Windows uses for NT LAN Manager authentication. With this hash in hand, an attacker can either relay it to internal services that accept NTLM without signing or Extended Protection for Authentication (EPA), or crack it offline if the underlying password is weak. In practical terms, a single opened message could give an adversary a foothold inside a corporate network.

Microsoft has confirmed active exploitation but has not named the threat actors, their targets, or the scale of the campaign. No indicators of compromise have been published. The company credits a researcher known as “nono” and Benoît Sevens — who reportedly used Anthropic’s Claude AI model as part of the discovery process — with finding the flaw.

Crucially, the Outlook Preview Pane is not an attack vector for this vulnerability; the victim must actually open the malicious file. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The fix ships through Office security updates, not the Windows cumulative update, meaning organizations that only patch Windows will leave Outlook exposed.

CISA wasted no time adding CVE-2026-124194 to its Known Exploited Vulnerabilities (KEV) catalog on November 10, setting a remediation deadline of November 24, 2026 for federal agencies.

The Bigger Picture: 63 Critical Flaws

Beyond the zero-day, Microsoft rated 63 of this month’s vulnerabilities as Critical. Elevation of Privilege bugs account for roughly 49% of the total release, Remote Code Execution flaws make up 27%, and Information Disclosure issues account for another 14%.

Several of the Critical fixes carry the maximum CVSS score of 9.8 and require no authentication to exploit:

• CVE-2026-119958 — A Windows LDAP out-of-bounds write that an unauthenticated attacker can trigger over the network with no user interaction. Since LDAP runs on every domain controller, this places Active Directory infrastructure squarely in the crosshairs.
• CVE-2026-116928 — A Windows Search RCE that can be reached through Exchange Server. Zero Day Initiative’s analysis notes that an unauthenticated attacker can trigger code execution without the recipient even opening anything, making it potentially more dangerous than any of the nine dedicated Exchange Server fixes this month.
• CVE-2026-112967 — A heap overflow in the Xbox Live Networking Service, reachable without authentication or user interaction.

Other notable Critical fixes include an Exchange Server RCE (CVE-2026-118207, CVSS 8.8), three Outlook RCEs each scoring 8.8, a Windows Schannel RCE (CVE-2026-119952), and multiple Windows Message Queuing RCEs. Analysts estimate that roughly 30 of this month’s vulnerabilities could be considered “wormable” — meaning they can be exploited remotely without authentication or user interaction, potentially enabling self-propagating malware.

Windows Search Turns Exchange Into a Zero-Click Target

CVE-2026-116928 deserves special attention. While the flaw technically resides in Windows Search, it can be triggered through Exchange Server as a zero-click attack — no user interaction required. Because the fix ships in the Windows cumulative update rather than in the Exchange update, administrators need to apply both patches during the same maintenance window. Organizations still running older, unsupported versions of Exchange Server have no fix available for this flaw.

Who Is Affected

The scope is vast. Windows accounts for 726 of the patched vulnerabilities, followed by Office with 174, SQL Server with 59, developer tools with 53, SharePoint Server with 27, Azure services with 20, and Exchange Server with 9. Microsoft also republished 165 CVEs from third-party components.

Notably, this month marks the final security update for Windows 11 version 23H2 Enterprise and Education editions. Devices running those editions will no longer receive monthly security patches. End-of-support also applies to .NET 8, .NET 9, and PowerShell 7.4.

Beyond Microsoft: SAP Ships Four CVSS 10.0 Fixes

Microsoft was not the only vendor delivering urgent patches on November 10. SAP’s November 2026 Security Patch Day included 35 new security notes, with nine rated HotNews. Four vulnerabilities received the maximum CVSS score of 10.0 — all exploitable without authentication. These include memory corruption bugs in SAP NetWeaver and Web Dispatcher (dubbed “ICM2SHELL”), a broken access control flaw in SAP Gateway (“PROXYGATE”), and a SAML2 authentication bypass in SAP NetWeaver ABAP. Adobe also released fixes for roughly 110 vulnerabilities across nine products the same day.

What You Should Do Now

Given the scale of this release, a phased patching approach is advisable, prioritized by active exploitation and real-world exposure:

1. Patch Outlook and Office first. Deploy the Microsoft 365 Apps and Office LTSC security updates across your fleet immediately. The same updates also close the three Critical Outlook RCEs rated 8.8.
2. Harden NTLM during rollout. Block outbound SMB traffic on TCP port 445 to the internet, enforce SMB and LDAP signing, enable EPA, and add privileged accounts to the Protected Users security group.
3. Patch Exchange Server. Apply both the Windows cumulative update (for CVE-2026-116928) and the Exchange security update (for CVE-2026-118207) together.
4. Prioritize domain controllers. Patch the LDAP, Kerberos, Active Directory, Schannel, and CredSSP flaws as a group — they all protect the same identity tier.
5. Address network-facing services. Update DNS, DHCP, Message Queuing, IIS, and WDS hosts. Disable Message Queuing wherever it is unused.
6. Verify with at least two signals. Confirm patch installation through endpoint management reporting and vulnerability scans. Failed installs, deferred reboots, and offline devices create silent gaps.

With more than 5,000 Microsoft vulnerabilities patched in 2026 so far, the pace of vulnerability disclosure continues to accelerate. The steady climb in monthly patch volumes reflects a broader trend: AI-assisted code analysis by both researchers and internal teams is surfacing more flaws faster than ever. For defenders, the message is clear — automate what you can, prioritize ruthlessly, and verify everything.