Microsoft’s November Patch Tuesday is the second consecutive update with more than a thousand fixes. The main threat is the CVE-2026-124194 vulnerability in Microsoft Outlook, which, according to Microsoft, is already being exploited by attackers. Exploitation allows an attacker to intercept the victim’s NTLMv2 authentication hash, opening the door to user impersonation. CISA has added the vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 24, 2026. All organizations using Outlook should prioritize installing the patch.
Update scale: discrepancy in counts
According to the Microsoft release page, the update covers 1,259 vulnerabilities. However, Tenable’s count shows 1,093 CVEs addressed in the release, of which 63 are rated critical, 1,029 important, and one moderate. The discrepancy is likely due to differences in counting methodology: Microsoft includes third-party CVE identifiers in the total (the source material mentions 165 such entries), whereas Tenable may only be counting vulnerabilities directly fixed by Microsoft. These figures should not be treated as interchangeable.
We have already reviewed the October Patch Tuesday, which also exceeded the one‑thousand‑fix mark. The November release confirms that this scale is becoming the new normal for Microsoft.
CVE-2026-124194: spoofing vulnerability in Outlook
The central vulnerability in this update is CVE-2026-124194, classified as a spoofing vulnerability in Microsoft Outlook. According to Microsoft and Tenable, it has a CVSS score of 6.5 and a moderate severity rating.
The attack mechanism works as follows: an attacker sends the victim a specially crafted message file or Office document. If the user opens this file in a vulnerable version of Outlook, the client initiates a connection to a network resource controlled by the attacker without displaying the standard external content warning. As a result, authentication data — the NTLMv2 hash — is leaked and can be used to impersonate the user in subsequent attacks.
Important exploitation constraints, as confirmed by Microsoft:
- The victim must have network connectivity
- User interaction is required — the malicious file must be opened
- Automatic exploitation with no user action has not been confirmed
Despite the moderate CVSS rating, the vulnerability warrants priority attention. It is the only CVE in this update that has been added to the CISA KEV catalog, confirming active exploitation. Microsoft has not disclosed which specific threat actor or group is using the vulnerability and has not provided technical exploitation details. It is also unknown whether exploitation began before or after the vulnerability was discovered by researchers.
Other notable vulnerabilities
In addition to Outlook, the update closes a number of critical remote code execution vulnerabilities:
- CVE-2026-116928 — out-of-bounds write in the Windows Search component, allowing code execution over the network
- CVE-2026-119958 — out-of-bounds write in Windows LDAP, also enabling remote code execution over the network
- CVE-2026-119952 — remote code execution in Windows Schannel
- CVE-2026-95962 — remote code execution in the Windows Virtual Filtering Platform
- CVE-2026-112967 — heap buffer overflow in Windows Xbox Live Networking Service with the potential for remote code execution over the network
- CVE-2026-119990 — privilege escalation in Azure OpenAI
The available source material does not include information on affected versions for the listed CVEs, so it is recommended to consult the MSRC portal for complete configuration details.
Impact assessment
CVE-2026-124194 presents the greatest practical risk for organizations where Outlook is the standard email client — which is the vast majority of corporate environments. A captured NTLMv2 hash can be used to authenticate as the victim, access their data, and potentially move laterally within the internal network. However, the success of such follow‑on attacks depends on the specific environment configuration and is not guaranteed in every case.
Vulnerabilities in LDAP and Windows Search are particularly dangerous for server infrastructures where these components handle network requests. The vulnerability in Azure OpenAI affects organizations using Microsoft’s cloud AI services.
Recommendations
- Immediately install the patch for CVE-2026-124194 — this is the only vulnerability with confirmed exploitation and a CISA KEV deadline of November 24, 2026
- Check which of the listed components (Windows Search, LDAP, Schannel, Xbox Live Networking Service, Azure OpenAI) are used in your infrastructure and prioritize patches for them
- Consider restricting outbound SMB connections and NTLM authentication to external resources as an additional measure against hash leakage
- Train users not to open attachments from untrusted sources — exploitation of CVE-2026-124194 requires the victim to open the malicious file themselves
Patch prioritization for this update is straightforward: CVE-2026-124194 in Outlook comes first as the only vulnerability with confirmed exploitation and a regulatory deadline. Next are the critical remote code execution vulnerabilities in Windows network components (LDAP, Search, Schannel), especially on servers accessible from the network. The full list of affected versions and configurations is available on the MSRC portal.
