Microsoft’s November 2026 Patch Tuesday updates address 1,094 vulnerabilities in its products, including an Outlook bug that the company says was exploited.
Day zero, followed as CVE-2026-124194has been classified as an identity theft flaw and stems from Outlook not alerting users before a potentially dangerous action takes place.
Microsoft gave it a severity rating of “moderate” and a CVSS score of 6.5. The company’s advisory does not provide any information on the observed attacks.
For an attack to work, the victim must be tricked into opening a malicious file, according to Microsoft.
“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to a network location controlled by the attacker without displaying the usual external content warning, potentially disclosing authentication information that could be used to impersonate the user,” the tech giant said.
The flaw cannot be triggered through the preview pane, Microsoft said. It also clarified: “This vulnerability leaks a user’s NTLMv2 hash to the attacker who could use it to authenticate as the user. »
The vulnerability was not publicly disclosed before the patch became available. Affected products include Microsoft 365 Apps for Business, Office LTSC 2021, and Office LTSC 2024.
Microsoft’s notice attributes the discovery to a researcher using the nickname “nono” and to Benoît Sevens. Acknowledgment for Sevens mentions the use of Anthropic’s Claude AI model.
Windows represents 726 of vulnerabilities fixed this monthfollowed by Office with 174. Microsoft also fixed 59 vulnerabilities in SQL Server, 53 in Developer Tools, 27 in SharePoint Server, 20 in Azure and nine in Exchange Server.
Additionally, the company republished 165 third-party CVEs, noting that Chrome vulnerabilities are not listed.
Microsoft’s release summary lists critical severity updates for Windows 10, Windows 11, Windows Server 2016 to 2025, Office, Exchange Server Subscription Edition, Edge, and Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the list.
The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities. With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year.
This month’s updates are also the last for Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will no longer receive monthly security updates.
Adobe’s latest Patch Tuesday updates address approximately 110 vulnerabilities across nine products.
Related: Node2Shell: Brotli flaw triggers patching of Microsoft, Node.js and Python packages
Related: Microsoft fixes two dozen RCE flaws in Office
Related: Microsoft fixes a record number of 974 vulnerabilities, including two Zero-Day exploited
