Microsoft's November 2026 Patch Tuesday Fixes 1,252 Vulnerabilities, Including Exploited Outlook Zero-Day

Summary

Microsoft's November 2026 updates address 1,252 vulnerabilities, including an exploited Outlook spoofing flaw that can expose NTLMv2 hashes. The roundup details critical RCE and privilege-escalation flaws across Office, Windows services, LDAP, AD DS, Exchange and Hyper‑

Key points

Microsoft addressed 1,252 vulnerabilities, including 68 rated Critical and one exploited zero-day, according to the article.
Microsoft confirms CVE-2026-124194 is exploited in the wild; opening a crafted Outlook message file can trigger an outbound connection and disclose an NTLMv2 hash. The article says the Preview Pane is not an attack vector for this flaw.
Eight Critical Office RCE vulnerabilities can execute when a malicious email or document is selected for preview, without opening it or enabling macros.
CVE-2026-119958 is an unauthenticated network RCE in Windows LDAP; the article also describes Critical RCE and privilege-escalation flaws in Active Directory Domain Services.
CVE-2026-116928 affects Windows Search: a crafted email attachment sent to Exchange can be processed for indexing without the recipient opening it.
The article describes eight Hyper-V privilege-escalation flaws, including guest-to-host escape paths and a flaw that can grant VTL1 privileges.

Article Details

Vulnerability Types: Spoofing
Out-of-bounds write
Heap-based buffer overflow
Use-after-free
Incorrect authorization
Race condition
Double-free
Use of an incorrectly resolved name or reference
Severity: Moderate to Critical; CVSS scores range from 6.4 to 9.8. The exploited zero-day, CVE-2026-124194, is rated Moderate with a score of 6.5.
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe described Active Directory Domain Services and Hyper-V flaws can let an attacker with the required foothold escalate privileges, including to SYSTEM or VTL1.T1110.002 · Password CrackingThe article says the NTLMv2 hash disclosed by CVE-2026-124194 can be cracked offline to impersonate the user.T1187 · Forced AuthenticationOpening a specially crafted Outlook message file can make Outlook connect to an attacker-controlled network location and disclose the victim's NTLMv2 hash.T1203 · Exploitation for Client ExecutionMalicious Outlook or Word content can trigger code execution when selected in the Preview Pane.T1210 · Exploitation of Remote ServicesThe article describes network exploitation of remote services, including sending specially crafted LDAP calls to a listening server and triggering SMB server code execution.T1566.001 · Spearphishing AttachmentMalicious email attachments or documents are described as delivery paths for vulnerabilities that execute when previewed or processed.T1611 · Escape to HostThe article describes guest-to-host escape through Hyper-V vulnerabilities, allowing an attacker operating inside a guest VM to execute code on the host.

CVE

Vendors

MicrosoftMicrosoft addressed 1,252 vulnerabilities in its November 2026 security update release, including one exploited zero-day vulnerability and 68 Critical vulnerabilities.

Products

Active Directory Domain ServicesIdentity platform components face elevated risk this month with Critical flaws in both Lightweight Directory Access Protocol (LDAP) and Active Directory Domain Services (AD DS).Microsoft Exchange ServerCritical RCE Vulnerability in Microsoft Exchange Server Microsoft Hyper-VWindows Hyper-V sees an unusually high concentration of privilege escalation vulnerabilities this month, with eight CVEs spanning multiple flaw classes.Microsoft OfficeWindows received the most patches this month with 745, followed by ESU with 658, and Microsoft Office with 201.Microsoft OutlookExploited Zero-Day Spoofing Vulnerability in Microsoft Outlook Microsoft WindowsWindows received the most patches this month with 745, followed by ESU with 658, and Microsoft Office with 201.Windows Print SpoolerCritical RCE Vulnerability in Windows Print Spooler Windows Remote Desktop ServicesCritical Elevation of Privilege Vulnerability in Windows Remote Desktop Services Windows SearchCVE-2026-116928 is an out-of-bounds write in the Windows Search component.Windows SMB ServerCritical RCE Vulnerability in Windows SMB Server