Microsoft’s November 2026 Patch Tuesday updates fix 1,094 vulnerabilities across its products, including an Outlook bug that the company says has been exploited.
The zero-day, tracked as CVE-2026-124194, has been classified as a spoofing flaw and stems from Outlook not alerting users before a potentially dangerous action takes place.
Microsoft has assigned it a severity rating of ‘moderate’ and a CVSS score of 6.5. The company’s advisory provides no information about the observed attacks.
For an attack to work, the victim needs to be tricked into opening a malicious file, according to Microsoft.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user,” the tech giant said.
The flaw cannot be triggered through the Preview Pane, Microsoft said. It also clarified, “This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.”
The vulnerability was not publicly disclosed before the fix became available. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.
Microsoft’s advisory credits a researcher using the moniker ‘nono’ and Benoît Sevens with the discovery. The acknowledgment for Sevens mentions the use of Anthropic’s Claude AI model.
Windows accounts for 726 of the flaws patched this month, followed by Office with 174. Microsoft also resolved 59 vulnerabilities in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, and nine in Exchange Server.
In addition, the company republished 165 CVEs from third parties, noting that Chrome vulnerabilities are not listed.
Microsoft’s release summary lists critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the list.
The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities. With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year.
This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates.
Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products.
Related: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
Related: Microsoft Patches Two Dozen RCE Flaws in Office
Related: Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days
