Microsoft Ships a Record 1,000-Plus Fixes, but One Outlook Bug Already Under Attack Can Hand Hackers Your Password Hash

Microsoft’s November 2026 Patch Tuesday is one of the biggest on record, and buried inside it is a single bug that attackers were already using before the fix shipped. The flaw, an Outlook issue tracked as CVE-2026-124194, carries only a “moderate” rating. Security researchers say that label undersells it, because opening one booby-trapped message file can hand an attacker what they need to log in as the victim.

For companies that run on Microsoft 365, Exchange and Active Directory, this month’s job is not “patch everything eventually.” It is “patch the right things this week.”

A Second Straight Month Above 1,000 Fixes

Counts vary depending on what gets included. SecurityWeek and The Register put the total at 1,094 vulnerabilities across Microsoft products. BleepingComputer, using a wider count, reports a record-breaking 1,235 flaws, 66 of them rated Critical, including 48 remote code execution bugs.

According to SecurityWeek, Windows accounts for 726 of the fixes, followed by Office with 174. SQL Server has 59, developer tools 53, SharePoint Server 27, Azure 20 and Exchange Server nine. The Register notes that October’s release was even bigger, at 1,474 CVEs. That makes November the second month in a row above the 1,000 mark.

Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, told The Register that back-to-back months like this show “automated bug-hunting has permanently reset patch volume,” and that AI is making patch-diffing and exploit-writing close to instant. Jake Knott, head of threat intelligence at watchTowr, put the mood among defenders more bluntly: “Maybe we should just go home.”

The Outlook Bug Attackers Are Already Using

Microsoft classifies CVE-2026-124194 as a spoofing flaw with a CVSS score of 6.5. Here is how it works, based on Microsoft’s advisory as quoted by SecurityWeek. An attacker sends a specially crafted message file and convinces the user to open it in Outlook. Outlook then connects to a network location the attacker controls, without showing its usual external-content warning. That connection leaks the user’s NTLMv2 password hash, which the attacker can use to authenticate as that user. BleepingComputer adds that captured hashes can also be cracked offline.

A few details matter for triage:

• The flaw cannot be triggered just by viewing a message in the Preview Pane. The user has to open the file, Microsoft says.
• Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, per SecurityWeek.
• A Suped analysis lists the fixed builds as 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for LTSC 2024. Microsoft 365 Apps builds depend on the update channel.
• CISA added the bug to its Known Exploited Vulnerabilities catalog on November 10. U.S. federal civilian agencies have until November 24 to fix it, according to the same analysis.

Microsoft has not said who is exploiting the flaw or when the attacks started. “It’s labeled spoofing, but the impact is bigger than the name suggests,” Childs wrote in his monthly review, as quoted by The Register. Now that a patch is public, other attackers can study it to work out the bug and target companies that are slow to update.

The Zero-Click Bugs That May Matter Even More

Only the Outlook flaw is confirmed as exploited, but it is not necessarily the most dangerous fix in the batch. The Register highlights two critical zero-click bugs, both scored 9.8 out of 10:

• CVE-2026-116928, an out-of-bounds write in the Windows Search component. According to Microsoft, an attacker can exploit it through Exchange just by sending an email with a crafted attachment. Exchange indexes the attachment automatically, so nobody has to open anything.
• CVE-2026-119958, a flaw in Windows’ LDAP implementation. Crafted requests could let an unauthenticated attacker run code remotely, which could put domain controllers at risk.

Childs also counts 30 CVEs this month that carry “wormable” risk, meaning they need no login and no user action over a network. There is even a critical 9.8-rated heap overflow in the Windows Xbox Live Networking Service (CVE-2026-112967). That is a reminder that consumer-facing components ship on business PCs too.

Why It Matters for Business

Email is still the front door. The exploited bug and the worst zero-click bug both arrive by email. One needs a single click from an employee. The other needs nothing at all. A stolen NTLM hash can be the first step toward a business email compromise or ransomware attack, and the exposure is the same whether you have 20 employees or 20,000.

Volume breaks old patch habits. With more than 1,000 fixes a month, “test everything, then deploy in 30 days” no longer works. Childs’ advice to defenders is to drop broad triage and act on risk. Patch Exchange and domain controllers first to shut down zero-click compromise. Ring-fence exposed services like DNS and DHCP to limit wormable spread. Then verify any manual fixes on cloud services.

Smaller firms carry real exposure. Many small and midsize businesses run Office LTSC or let users control updates on their own machines. Malwarebytes recommends checking Office separately from Windows Update, under File > Account > Update Options > Update Now. On managed work devices, IT teams should confirm the build number rather than assume the update landed.

Defense in depth still pays off. Blocking outbound SMB traffic at the network edge, restricting NTLM where possible, and requiring multi-factor authentication all make a leaked hash less useful. Those controls cost little compared with recovering from an account takeover.

The Bottom Line

November’s record release turns patching into a prioritization problem. The order this week: the actively exploited Outlook flaw on every desktop, the zero-click Exchange and LDAP bugs on servers, and the wormable network services after that. Companies that move fast close the gap before attackers finish studying the patches. Companies that wait 30 days may find someone else got there first.

Sources: SecurityWeek, The Register, BleepingComputer, Malwarebytes, Suped.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous