Microsoft's November 2026 Patch Tuesday addressed 1,094 CVEs, including one actively exploited Outlook spoofing flaw that can leak NTLMv2 hashes. Counts vary by source because some include Edge Chromium and open-source component fixes.
By Hermes-Vector AI Desk
Microsoft released its November 2026 Patch Tuesday security updates on November 10, 2026, addressing 1,094 CVEs across Windows, Microsoft 365, Office apps, SQL Server, SharePoint Server, Exchange Server, Azure, Defender and developer tools, according to Microsoft's release notes cited by Shattered. Microsoft rated 63 of the flaws Critical, 1,029 Important and one Moderate.
The only actively exploited zero-day in the release is CVE-2026-124194, a Microsoft Outlook Spoofing Vulnerability. Microsoft rates it Moderate with a CVSS score of 6.5.
Microsoft describes the attack as follows:
"An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook."
"Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Exploitation requires network connectivity and user interaction."
The flaw leaks the user's NTLMv2 authentication hash, which an attacker can capture and potentially crack offline or relay to impersonate the user. Reporting based on Microsoft's description says the bug cannot be triggered through Outlook's Preview Pane; the victim must open the file.
Microsoft credited the discovery of the Outlook flaw to Benoît Sevens "using Claude with Anthropic" and to a researcher using the handle "nono," according to MLQ.ai citing Microsoft's Security Update Guide. Microsoft has not said who is attacking Outlook, when the attacks began or how widespread they are, Shattered reports.
CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10, 2026, and gave federal civilian agencies until November 24, 2026 to patch it, according to Shattered and MLQ.ai.
Different outlets report different totals for the November release because they count different scopes:
BleepingComputer also reports that today's total excludes 108 flaws fixed earlier this month, including one Entra Device Registration, 82 Mariner, and 25 Microsoft Edge flaws.
Other companies released security updates in November 2026, according to BleepingComputer:
The November Patch Tuesday continues a trend of high vulnerability volume, following September's 974 CVEs and October's 1,413 CVEs. The exploited Outlook flaw is rated Moderate, below Critical, continuing a pattern where the bug attackers actually use carries a rating below Critical. Security teams that prioritize by severity alone risk patching higher-scored theoretical flaws while the actively exploited zero-day remains unpatched. The fix ships through the Microsoft 365 Apps and Office LTSC security updates, not the Windows cumulative update alone, so organizations that deploy only Windows updates may stay exposed until the Office update lands.
Sources
This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.
The day's checked news, by email
One short email a day with the top stories. Free, and you can unsubscribe in one click.
Or follow for the latest news:
No comments yet. Start the discussion.
TechTrending
Police seized unknown meat from a Glasgow shop during Operation Machinize, a UK-wide operation targeting economic crime and customs evasion. The meat was found alongside rotten meat and sent for testing.
SpaceX's second-generation portable satellite dish includes a removable battery rated for up to 4.5 hours, with preorders by invitation for select US customers.