Microsoft Patches 1,259 Vulnerabilities, Including Actively Exploited Outlook Zero-Day
FHN 
Microsoft has released its November 2026 Patch Tuesday security updates, addressing 1,259 vulnerabilities across its software portfolio. The release includes an actively exploited vulnerability in Microsoft Outlook that could allow attackers to capture users’ NTLMv2 authentication hashes.
According to Microsoft’s security disclosures, this is the second consecutive month in which the number of patched vulnerabilities has exceeded 1,000. The latest updates cover Windows, Office, SQL Server, SharePoint and other Microsoft products.
Outlook Zero-Day Could Expose NTLMv2 Authentication Hashes
The most concerning vulnerability is CVE-2026-124194, an Outlook spoofing vulnerability with a CVSS score of 6.5.
The flaw occurs because Microsoft Outlook does not properly warn users before performing certain unsafe network connections.
An unauthenticated attacker can send a specially crafted message file and convince a victim to open it using an affected version of Outlook. Opening the file can cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning.
This interaction could expose authentication information, including an NTLMv2 hash, which attackers may attempt to crack or use in subsequent attacks.
Microsoft confirmed that the vulnerability has been exploited in the wild. However, the company has not publicly attributed the attacks to a specific threat group.
CISA Adds the Vulnerability to Its KEV Catalog
Following Microsoft’s disclosure, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-124194 to its Known Exploited Vulnerabilities (KEV) catalog.
Federal Civilian Executive Branch agencies have been directed to apply the security update by November 24, 2026.
The inclusion highlights the urgency of addressing the vulnerability despite its Moderate severity rating.
Additional Critical Vulnerabilities Patched
Beyond the Outlook flaw, Microsoft’s November updates address vulnerabilities across several components, including:
- Windows Search
- Lightweight Directory Access Protocol (LDAP)
- Windows Schannel
- Windows Virtual Filtering Platform
- Windows Xbox Live Networking Service
- Azure OpenAI
Some of these vulnerabilities could allow remote code execution, while others may enable privilege escalation or information disclosure.
One notable issue, CVE-2026-119990, affects Azure OpenAI and is classified as a privilege escalation vulnerability.
The updates also address multiple vulnerabilities in Windows components that could affect enterprise infrastructure and endpoint security.
About the Author
