Microsoft’s November Patch Tuesday fixed more than 1,000 vulnerabilities for the second month running, including an Outlook spoofing zero-day, CVE-2026-124194, that attackers exploited before a patch existed.
The Outlook flaw carries a CVSS score of 6.5 and affects how the mail client handles a specially crafted message file. According to Microsoft’s advisory, opening such a file causes Outlook to connect to an attacker-controlled location without showing the usual external-content warning. That silent connection can leak the victim’s NTLMv2 hash, which an attacker can then use to impersonate the user. Exploitation requires network access and some user interaction.
How CVE-2026-124194 Bypasses Outlook’s External-Content Warning
Outlook normally warns users before it reaches out to external resources, a safeguard meant to stop precisely this kind of credential leak. CVE-2026-124194 removes that prompt. A victim who opens the crafted message file never sees a warning, yet the client authenticates to a server the attacker controls and hands over an NTLMv2 hash in the process.
NTLMv2 hashes are not plaintext passwords, but captured hashes can be used to impersonate the account that produced them. That makes a quiet, warning-free connection a useful primitive for attackers seeking a foothold inside a network.
Affected Office Builds and Researcher Credits
The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 builds before 16.0.14334.21048, and Office LTSC 2024 builds before 16.0.17932.21140. Microsoft credited a researcher known as “nono” and Benoit Sevens, who worked with Anthropic’s Claude, for reporting the flaw.
CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on the day the patches were released. Federal civilian agencies have until November 24 to apply the fix.
A Second Month Above 1,000 Fixes Strains Patch Teams
The raw patch volume is the other headline. Tallies differ depending on what is counted: figures published for the release range from 1,093 to 1,259. The higher total includes 165 CVEs in non-Microsoft products that Microsoft’s update guide also lists. By one breakdown, the release addressed 726 Windows flaws, 174 in Office, 61 in developer tools, 59 in SQL Server and 27 in SharePoint.
More than 5,100 CVEs have now been patched in 2026, a pace that gives administrators little room to triage by hand. Two consecutive months above 1,000 fixes suggest that the volume is no longer an anomaly.
Critical Remote Code Execution Bugs in Windows and Azure
Several critical flaws sit alongside the exploited Outlook bug. They include CVE-2026-116928, a remote code execution flaw in Windows Search; CVE-2026-119958, a remote code execution flaw in LDAP; CVE-2026-119952, a Schannel remote code execution flaw; CVE-2026-95962 in the Virtual Filtering Platform; and CVE-2026-112967 in Xbox Live. CVE-2026-119990 is an Azure OpenAI privilege escalation.
One analysis describes critical Windows Kerberos, LDAP, DNS, DHCP and iSCSI flaws rated CVSS 9.8, and another security outlet counts about 30 wormable bugs in the release. Counts of critical and wormable flaws also vary by publisher, so organizations should rely on Microsoft’s own advisories for their asset-specific exposure.
Why an Exploited Medium-Severity Bug Still Gets Priority
The Outlook flaw’s 6.5 score would ordinarily place it below many of the month’s critical fixes. Active exploitation changes that ranking. Defenders typically weigh in-the-wild abuse above raw severity, and CISA’s catalog entry formalizes the point for federal agencies with a two-week deadline.
Credential-leak bugs of this kind also tend to be the first step in a longer chain. A captured hash can support lateral movement or account impersonation well after the initial message is opened, so the damage is not limited to the machine that received the file.
The practical path is straightforward: install the November Office updates on the affected builds first, then work through the Windows critical fixes. For teams facing more than 1,000 patches in a single cycle, the exploited Outlook zero-day is the item that cannot wait.
