Microsoft November Patch Tuesday fixes over 1,000 flaws, including exploited Outlook bug
Summary
Microsoft’s November updates fix over 1,000 vulnerabilities, including an exploited Outlook flaw that could expose NTLMv2 hashes. The article also highlights a critical Windows Search flaw and explains how to install Office and Windows updates.
Key points
- Microsoft says the November release fixes more than 1,000 vulnerabilities, including 48 critical remote code execution flaws.
- CVE-2026-124194 is an exploited Outlook flaw; opening a specially crafted message file could trigger a connection to an attacker-controlled location and expose authentication information.
- The Outlook flaw has a CVSS score of 6.5; the article says exposed NTLMv2 hashes could be used to impersonate a user.
- CVE-2026-116928 is a Windows Search Component out-of-bounds write flaw with a CVSS score of 9.8.
- Microsoft describes a scenario where Exchange Server automatically processes a malicious email attachment for indexing, potentially enabling code execution with the affected service’s permissions; Microsoft has not reported exploitation.
- The article advises installing Office updates as well as Windows updates and provides steps to check for and apply them.
Article Details
- Event Type
- Microsoft November Patch Tuesday security release addressing more than 1,000 vulnerabilities, including an actively exploited Outlook flaw and 48 critical remote code execution vulnerabilities.
- Impact
- CVE-2026-124194 is being exploited to make Outlook connect to an attacker-controlled network location, potentially exposing a user's NTLMv2 hash for impersonation. Exploitation requires the user to open a specially crafted message file. CVE-2026-116928 could allow remote code execution when a malicious email attachment is automatically processed for indexing by Exchange Server; Microsoft has not reported exploitation of this flaw. Microsoft has released fixes, and the article advises installing Office and Windows updates.
MITRE ATT&CK
CVE
CVE-2026-116928Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +14 moreOne other vulnerability I want to highlight is CVE-2026-116928 (CVSS score 9.8 out of 10):CVE-2026-124194Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Office LTSC 2021; +1 moreWe’ll start with CVE-2026-124194, an Outlook vulnerability that attackers are already exploiting. It has a CVSS score of 6.5 out of 10 and could expose authentication information that attackers could use to impersonate
Vendors
Products
Microsoft Exchange Serverdescribes an attack in which a malicious email attachment is processed automatically for indexing by Exchange Server. In that scenario, the recipient does not need to open the email or attachment. Processing it couldMicrosoft WindowsWhile Windows updates address many of this month’s vulnerabilities, readers should check for Office updates as well: the exploited Outlook flaw is patched through the affected Office products.OfficeWhile Windows updates address many of this month’s vulnerabilities, readers should check for Office updates as well: the exploited Outlook flaw is patched through the affected Office products.OutlookMicrosoft’s November Patch Tuesday fixes more than 1,000 Microsoft vulnerabilities, including an Outlook flaw that attackers are already exploiting to steal authentication information.Windows Search Component“Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.”