Microsoft Patch Tuesday Fixes 1,235 Flaws Including Actively Exploited Outlook Zero-Day

Cybersecurity 11 NOV 2026 1,485 words 7 min read By Tech Desk

Microsoft rolled out its November 2026 Patch Tuesday update on November 10, 2026, addressing a record-breaking 1,235 security flaws across its product portfolio. The update targets 66 critical vulnerabilities, with 48 classified as remote code execution and 15 as elevation of privilege issues. Among the fixes is CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook that was actively exploited in the wild before the patch was released.

An unauthenticated attacker could trick a user into opening a specially crafted Microsoft Office file. When the file was opened, Outlook would connect to an attacker-controlled network location without showing the usual external-content warning. This connection could expose the user's NTLMv2 authentication hash, which attackers could then capture and use to impersonate the victim in follow-on attacks. Microsoft warns that exploitation requires network connectivity and user interaction.

CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook. It received a CVSSv3 score of 6.5 and is rated moderate. An attacker could exploit this vulnerability by convincing a target to open a crafted Microsoft Office file. Successful exploitation would allow an attacker to obtain the target's valid NTLMv2 hash, which can then be used to impersonate that user in follow-on attacks.

According to Microsoft, this vulnerability was exploited in the wild as a zero-day. Additionally, the advisory credits this discovery to a security researcher that used Claude, the large language model from Anthropic, though no specific version of Claude was noted in the advisory. The researcher identified the flaw through analysis of malicious attachments in phishing campaigns that had been circulating in the wild.

The attack chain began with a malicious file that appeared legitimate to the user. When the file was opened in Outlook, the application would silently establish a connection to an attacker-controlled server. This connection would trigger Windows to attempt authentication to the remote server, exposing the user's NTLMv2 authentication hash. The hash could then be captured by the attacker and potentially cracked offline.

Once the attacker had the hash, they could use it to impersonate the victim in subsequent authentication attempts. This could lead to unauthorized access to corporate accounts, data exfiltration, or further lateral movement within the organization. The vulnerability is particularly dangerous because it does not require the attacker to have any prior access to the target system.

The Scale of the Patch Tuesday

Microsoft's November 2026 Patch Tuesday update addressed a record-breaking 1,235 security flaws across its product portfolio. The update targets 66 critical vulnerabilities, with 48 classified as remote code execution and 15 as elevation of privilege issues. Among the fixes is CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook that was actively exploited in the wild before the patch was released.

The November update also patched CVE-2026-118146, a critical remote code execution flaw in Windows Active Directory Domain Services. An authenticated attacker could exploit an incorrect authorization in AD DS to execute arbitrary code over a network. Similarly, CVE-2026-120002 affected Microsoft SharePoint Server with an elevation of privilege vulnerability that allowed attackers to gain higher privileges on compromised systems.

Other vendors released urgent fixes in the same cycle. Ivanti Connect Secure patched two zero-day vulnerabilities that had been chained in attacks since at least October 1. Google issued emergency updates for a Chrome vulnerability that was being exploited in zero-day attacks. Barracuda Networks released security updates for two vulnerabilities that allowed attackers to run commands with root privileges and were subsequently exploited.

The November update also patched CVE-2026-119952 in Windows Schannel, which allowed unauthenticated attackers to execute code over a network through a timing discrepancy. CVE-2026-121663 and CVE-2026-121662 in Visual Studio Code introduced security feature bypass and remote code execution respectively, both rated important with CVSS scores of 8.8 and 8.6.

Azure services also received urgent attention. Azure OpenAI patched CVE-2026-119990, an elevation of privilege vulnerability rated critical. Azure Pipelines received CVE-2026-119989, a remote code execution flaw rated important. Azure Managed Grafana patched CVE-2026-114160, an elevation of privilege issue rated critical.

For IT teams, the key takeaway is that patching is no longer optional. The update demonstrates that even well-established products like Outlook remain vulnerable to sophisticated exploitation techniques. Organizations that delay patching risk exposure to credential theft, lateral movement, and data exfiltration. The speed of the November update also highlights how quickly new vulnerabilities are discovered and remediated when vendors commit to aggressive patching schedules.

Security teams should verify that all affected systems have been updated within the next 72 hours. The rapid pace of the November update shows that vulnerabilities can appear and be exploited within days of discovery. Delaying patching increases the window of exposure for attackers.

Additionally, organizations should review their access controls and monitoring capabilities. The November update included fixes for elevation of privilege issues across multiple products, including Active Directory Domain Services, SharePoint Server, and Exchange Server. Attackers who successfully exploited these vulnerabilities gained higher privileges on compromised systems.

For those who missed the patch, Microsoft recommends running the latest cumulative updates immediately. The November update was part of a broader effort to address 1093 CVEs across the Windows ecosystem and Microsoft cloud services. The update also included fixes for vulnerabilities in third-party applications that integrate with Microsoft products, such as Visual Studio Code and Azure services.

Other Critical Vulnerabilities in the Same Update

Other critical fixes included CVE-2026-119952 in Windows Schannel, which allowed unauthenticated attackers to execute code over a network through a timing discrepancy. CVE-2026-121663 and CVE-2026-121662 in Visual Studio Code introduced security feature bypass and remote code execution respectively, both rated important with CVSS scores of 8.8 and 8.6.

What Organizations Need to Do

Organizations should prioritize patching systems as soon as possible. The November update alone fixed 287 products and components, with Microsoft Office Word receiving 65 patches and Microsoft Office Excel receiving 64. The update also addressed critical flaws in Azure OpenAI, Azure Pipelines, and Azure Managed Grafana, all rated as critical severity.

Looking Ahead

Microsoft's November Patch Tuesday demonstrates the growing urgency of proactive security management. The rapid response to a record number of vulnerabilities shows that vendors are increasingly focused on closing gaps before attackers can exploit them. However, the sheer volume of fixes also highlights the challenge of maintaining security across such a broad product portfolio.

For organizations, the lesson is clear: patching is not a one-time activity but an ongoing process. The November update should serve as a reminder that even mature products remain targets. Security teams should establish automated patching workflows and maintain regular vulnerability scanning to identify systems that may be behind on updates.

Looking forward, the trend toward more frequent and comprehensive patch cycles is likely to continue. As threat actors develop more sophisticated exploitation techniques, vendors will need to respond faster. Organizations that invest in robust patch management and continuous monitoring will be better positioned to defend against the evolving threat landscape.

Author

Research Special Operations, Tenable

Keywords

Cybersecurity, Microsoft Outlook, CVE-2026-124194, Patch Tuesday, Zero-Day, Remote Code Execution, Elevation of Privilege, Windows Security, Threat Landscape