cyber.hendryadrian.com
Security News · thehackernews.com

Microsoft Patches 1,259 Flaws, Including Actively Exploited Outlook Bug That May Expose NTLMv2 Hashes

· Original article ↗

Summary

Microsoft released patches for 1,259 flaws. One actively exploited Outlook bug may expose authentication information, including NTLMv2 hashes, when a user opens a crafted message file.

Key points

  • Microsoft patched 1,259 vulnerabilities across its software portfolio, the second consecutive month with more than 1,000 flaws.
  • Microsoft flagged Outlook flaw CVE-2026-124194 as actively exploited; it has a CVSS score of 6.5.
  • A crafted message file opened in affected Outlook versions could trigger a connection to an attacker-controlled network location and potentially expose authentication information, including an NTLMv2 hash.
  • Exploitation requires network connectivity and user interaction. Microsoft did not identify an actor or provide technical details about exploitation in the wild.
  • CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog, setting a November 24, 2026, remediation deadline for federal agencies.
  • The roundup also highlights remote code execution flaws in Windows Search, LDAP, Schannel, Virtual Filtering Platform, and Xbox Live Networking Service, plus an Azure OpenAI privilege escalation flaw.

Article Details

Event Type
Microsoft Patch Tuesday security update addressing 1,259 vulnerabilities across its software portfolio.
Impact
Microsoft said CVE-2026-124194 in Outlook is actively exploited. An unauthenticated attacker can send a specially crafted message file and, if the recipient opens it, cause Outlook to connect to an attacker-controlled network location without the usual external-content warning, potentially exposing authentication information such as an NTLMv2 hash. Microsoft said exploitation requires network connectivity and user interaction; it did not attribute the activity to a threat actor or provide technical details about exploitation in the wild. CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a November 24, 2026, remediation deadline for federal agencies. The update also addresses several other highlighted remote code execution and privilege escalation vulnerabilities.

MITRE ATT&CK

T1187 · Forced AuthenticationThe reported Outlook exploit can make the application connect to an attacker-controlled network location and potentially disclose authentication information after a user opens a crafted message file.

CVE

CVE-2026-112967Microsoft · Windows 10 Version 1809; Microsoft · Windows 10 Version 21H2; +6 moreWindows Virtual Filtering Platform (CVE-2026-95962), and Windows Xbox Live Networking Service (CVE-2026-112967), as well as a privilege escalation flaw in Azure OpenAI (CVE-2026-119990).CVE-2026-116928Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +14 morevulnerabilities of note include a number of remote code execution flaws impacting Windows Search (CVE-2026-116928), Lightweight Directory Access Protocol (CVE-2026-119958), Windows Schannel (CVE-2026-119952),CVE-2026-119952Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +14 moreSearch (CVE-2026-116928), Lightweight Directory Access Protocol (CVE-2026-119958), Windows Schannel (CVE-2026-119952), Windows Virtual Filtering Platform (CVE-2026-95962), and Windows Xbox Live Networking ServiceCVE-2026-119958Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +14 moreexecution flaws impacting Windows Search (CVE-2026-116928), Lightweight Directory Access Protocol (CVE-2026-119958), Windows Schannel (CVE-2026-119952), Windows Virtual Filtering Platform (CVE-2026-95962), andCVE-2026-119990Microsoft · Azure Open AILive Networking Service (CVE-2026-112967), as well as a privilege escalation flaw in Azure OpenAI (CVE-2026-119990).CVE-2026-124194Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Office LTSC 2021; +1 moreOf these, a Moderate-severity security flaw in Microsoft Outlook (CVE-2026-124194, CVSS score: 6.5) has been flagged as actively exploited by Microsoft.CVE-2026-95962Microsoft · Windows 10 Version 1809; Microsoft · Windows 10 Version 21H2; +13 moreProtocol (CVE-2026-119958), Windows Schannel (CVE-2026-119952), Windows Virtual Filtering Platform (CVE-2026-95962), and Windows Xbox Live Networking Service (CVE-2026-112967), as well as a privilege escalation flaw

People

Benoit SevensMicrosoft credited Anthropic's Benoît Sevens, using Claude, with discovering and reporting the Outlook vulnerability CVE-2026-124194.Jack BicerAction1 director of vulnerability research who discussed the potential consequences of attackers capturing authentication hashes through the Outlook flaw.Jake KnottwatchTowr head of threat intelligence who advised security teams to prioritize exposed components and vulnerabilities already exploited in the wild.nonoMicrosoft credited Nono with discovering and reporting the Outlook vulnerability CVE-2026-124194.Satnam NarangTenable senior staff research engineer whose reported figure was cited for the number of CVEs Microsoft had addressed that year.

Vendors

MicrosoftMicrosoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws.

Products

Azure OpenAIand Windows Xbox Live Networking Service (CVE-2026-112967), as well as a privilege escalation flaw in Azure OpenAI (CVE-2026-119990).Microsoft WindowsThese cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers. More thanOfficeThese cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers. More thanOutlookOf these, a Moderate-severity security flaw in Microsoft Outlook (CVE-2026-124194, CVSS score: 6.5) has been flagged as actively exploited by Microsoft.SharePoint ServerWindows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers. More than 500 flaws relate toSQL ServerThese cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers. More thanWindows Schannelimpacting Windows Search (CVE-2026-116928), Lightweight Directory Access Protocol (CVE-2026-119958), Windows Schannel (CVE-2026-119952), Windows Virtual Filtering Platform (CVE-2026-95962), and Windows Xbox LiveWindows SearchSome other vulnerabilities of note include a number of remote code execution flaws impacting Windows Search (CVE-2026-116928), Lightweight Directory Access Protocol (CVE-2026-119958), Windows Schannel (CVE-2026-119952),Windows Virtual Filtering PlatformDirectory Access Protocol (CVE-2026-119958), Windows Schannel (CVE-2026-119952), Windows Virtual Filtering Platform (CVE-2026-95962), and Windows Xbox Live Networking Service (CVE-2026-112967), as well as aWindows Xbox Live Networking ServiceSchannel (CVE-2026-119952), Windows Virtual Filtering Platform (CVE-2026-95962), and Windows Xbox Live Networking Service (CVE-2026-112967), as well as a privilege escalation flaw in Azure OpenAI

Countries

United StatesThe development has prompted the U.S. U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the flaw to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fix by

Related Articles