November 2026 Patch Tuesday: An Exploited Outlook Hash Leak Leads About 1,094 Microsoft Fixes
Microsoft’s November 2026 security release is one of the largest on record by raw count: about 1,094 newly published CVEs. The number that matters is smaller. Exactly one vulnerability is marked as exploited, CVE-2026-124194, an Outlook spoofing flaw rated only “Moderate” that hands an attacker the user’s NTLMv2 hash when a crafted message file is opened. CISA has added it to KEV with a 24 November deadline. Behind it sit two zero-click, unauthenticated 9.8s that will hit Exchange servers and domain controllers hardest.
| Jour zéro | CVE-2026-124194 · Outlook · CVSS 6.5 Moderate |
| Count | 1,094 new (1,093 Microsoft-assigned) |
| Critique | 63 (MAG212 count) |
| End of support | Windows 11 23H2 Ent/Edu: last month |
Ce qui s'est passé
[Confirmed] Of 1,342 entries in Microsoft’s November data, 1,094 were first published on 10 November: 1,093 assigned by Microsoft and one by VulDB. By MAG212’s count of that data, 63 Microsoft-assigned CVEs are Critical. Exactly one is marked exploited and none publicly disclosed. (MSRC) [Reported] SecurityWeek also counts 1,094; ZDI says “about 1,090” and calls the count “a bit confusing”. SecurityWeek notes 165 republished third-party CVEs (none from Chrome) and that this is the last month of updates for Windows 11 23H2 Enterprise and Education. ZDI counts 30 wormable CVEs by its own definition. (Semaine de la sécurité) (ZDI)
The Outlook zero-day: who is affected and how it works
[Confirmed] CVE-2026-124194 is a spoofing flaw (missing warning before an unsafe action) in Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024, rated “Exploitation Detected”, customer action required. A user must open a crafted message file; Outlook then connects to an attacker-controlled location without the usual warning and discloses the user’s NTLMv2 hash. The Preview Pane is not an attack vector. Credited to “nono” and Benoît Sevens. (MSRC) KEV: due 24 November, forensic triage “No”. (CISA KEV) [Reported] ZDI says the hash could be used “to authenticate as the user”. (ZDI) [Unknown] Who exploited it, against whom, the delivery method and IOCs.
The criticals to patch next (per ZDI; none reported exploited)
| CVE | Composant | CVSS | Pourquoi c'est important |
|---|---|---|---|
| CVE-2026-116928 | Windows Search RCE, reached through Exchange | 9.8 | Crafted attachment triggers when the server indexes it; no user action |
| CVE-2026-119958 | Windows LDAP RCE | 9.8 | No interaction; especially damaging on domain controllers |
| CVE-2026-119952 | Windows Schannel RCE | 8.1 | “Exploitation More Likely” despite high complexity |
| CVE-2026-112967 | Xbox Live Networking Service RCE | 9.8 | Unauthenticated heap overflow; ZDI sees real-world use as unlikely |
| CVE-2026-95962 | Windows Virtual Filtering Platform RCE | n / A | Use-after-free from a crafted packet, no auth, race condition |
| CVE-2026-119990 | Azure OpenAI elevation of privilege | 9.8 | Revised to no customer action needed |
Source: ZDI. CVSS for CVE-2026-95962 was not captured.
Look for, contain and remediate (in order)
- Deploy the November Office updates to Microsoft 365 Apps and Office LTSC 2021/2024. (MSRC)
- Patch Exchange servers and domain controllers first for CVE-2026-116928 and CVE-2026-119958. (ZDI) [MAG212 analysis] Zero-click and unauthenticated, so expect exploit development.
- [MAG212 analysis] Block outbound SMB/NTLM (TCP 445) to the internet and consider NTLM restrictions; review firewall logs for workstations, particularly Outlook, reaching internet hosts on 445.
- [MAG212 analysis] Reset passwords for anyone who reports opening an odd message file and review their sign-ins.
- Plan Windows 11 23H2 Enterprise/Education migrations. (Semaine de la sécurité)
Vérifier la récupération : patch reporting shows the November Office build on all Outlook clients and the November update on Exchange and DCs; outbound TCP 445 to the internet is blocked from inside. Lesson [MAG212 analysis]: this month’s only exploited bug is “Moderate”. Exploitation status should outrank CVSS, which is what KEV encodes.
Pourquoi c'est important
A leaked NTLMv2 hash can be cracked offline or relayed to authenticate as the user, which turns a single opened file into a foothold. Severity scores undersell this kind of bug, and the volume of this month’s release makes it easy to lose in the queue. The Windows Search and LDAP criticals are not exploited yet, but zero-click server bugs attract exploit developers quickly.
The bottom line
Ship the November Office update to every Outlook client first, put Exchange and domain controllers in the first server ring, and block outbound SMB/NTLM to the internet so the next hash-leak bug has nowhere to send credentials.
How we label evidence: [Confirmed] comes from a primary source such as a vendor or CISA; [Reported] from a secondary outlet; [Claimed] from an attacker or an unverified party; [MAG212 analysis] is our judgement; [Unknown] means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.
This story is part of MAG212 CYBER Daily, 11 November 2026, with the day’s other verified stories, the Defender’s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER. Par El Mostafa Ouchen.