Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities Including Outlook Zero-Day

Microsoft’s November 2026 Patch Tuesday release addresses 1,093 newly released vulnerabilities, including an exploited Outlook zero-day that can expose a user’s NTLMv2 authentication hash.

On November 10, updates were released for Windows, Microsoft Office, SQL Server, SharePoint, and other products. This update addresses 63 critical vulnerabilities, 1,029 important issues, and one moderate flaw among the newly released entries.

Outlook 0-Day Vulnerability

CVE-2026-124194 is an actively exploited Microsoft Outlook spoofing vulnerability that can expose a user’s NTLMv2 authentication hash. Microsoft rates it Moderate, with a CVSS score of 6.5, and identifies the underlying weakness as missing warnings about unsafe actions, tracked as CWE-356.

According to Microsoft’s advisory, an unauthenticated attacker can send a specially crafted message file and trick the recipient into opening it in Outlook. Opening the file can make Outlook connect to an attacker-controlled network location without showing the usual external-content warning. This connection can disclose authentication information that could be used to impersonate the victim.

Exploitation requires the user to open the malicious file and have network connectivity. The Preview Pane is not an attack vector. Microsoft confirms that attacks have occurred, but the advisory does not identify the attackers, victims, or scale of exploitation.

Affected products include 32-bit and 64-bit editions of Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. Administrators should prioritize the applicable security updates because exploitation is already underway, despite the Moderate severity rating.

The same release lists CVE-2026-124227 and CVE-2026-124228 as Important-rated Outlook code execution issues, neither of which is marked as exploited.

Critical Windows and Office Fixes

Among the Critical entries are CVE-2026-125136, affecting Windows Network Connected Devices Auto-Setup Service, and CVE-2026-125134, affecting Windows Function Discovery Resource Publication.

Both are classified as remote code execution vulnerabilities. CVE-2026-125137 affects the Windows Graphics Kernel and is classified as an elevation of privilege. The export marks none of these three vulnerabilities as publicly disclosed or exploited at release.

Office also receives Critical code execution fixes, including CVE-2026-124185 in Word and CVE-2026-124170 in Excel. Infrastructure teams should examine the DNS entries, including CVE-2026-96177, alongside fixes for DHCP, Hyper-V, and Remote Desktop components.

Microsoft’s Security Update Guide remains the reference for matching individual vulnerabilities to deployed products, rather than assuming every listed component exists across an entire network.

The exploited Outlook flaw deserves early attention despite its Moderate rating. Earlier reporting on the exploited Windows Shell zero-day provides another example of why exploitation status matters alongside severity.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities Including Outlook Zero-Day appeared first on Cyber Security News.