Microsoft Patches 1,093 Flaws, Including Exploited Outlook Bug
November 2026 Patch Tuesday fixes 63 critical vulnerabilities, and Microsoft confirms one Outlook flaw is already being actively exploited.
Updated on Nov. 10, 2026 in Cybersecurity
Microsoft released its November 2026 Patch Tuesday updates on November 10, addressing 1,093 newly disclosed vulnerabilities across Windows, Microsoft Office, SQL Server, and SharePoint. Microsoft confirmed active exploitation of CVE-2026-124194, an Outlook spoofing flaw that can expose a user's NTLMv2 authentication hash.
Why it matters
The actively exploited Outlook flaw can be triggered by a crafted message file that a recipient is tricked into opening, giving attackers a route to capture login credentials. Because the release is large and includes many critical-rated issues, organizations running affected Office and Microsoft 365 editions face a time-sensitive patching decision.
The release covers 1,093 vulnerabilities, with CVE-2026-124194 carrying a CVSS score of 6.5 and classified under CWE-356 for affected 32- and 64-bit Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. The Preview Pane is not an attack vector for this flaw, and the source does not detail remaining exposure after patching.
The players
Microsoft
Microsoft is the Redmond, Washington-based technology company that develops Windows, Office, and Outlook and publishes the monthly Patch Tuesday security updates.
The details
An unauthenticated attacker can send a specially crafted message file and trick the recipient into opening it in Outlook, which then connects to an attacker-controlled network location without the usual external-content warning. Two other Important-rated Outlook code execution issues, CVE-2026-124227 and CVE-2026-124228, were also addressed, though neither is marked as exploited.
Timeline
November 10, 2026: Microsoft releases November 2026 Patch Tuesday updates.
Season Trajectory
Microsoft's monthly Patch Tuesday cycle sets a regular rhythm for enterprise security teams, and this November release stands out for its size, with 1,093 vulnerabilities compared with the typical monthly batch. The confirmed active exploitation of an Outlook authentication-hash flaw adds urgency to an otherwise routine update.
Users and administrators running Outlook, Office LTSC 2021 or 2024, or Microsoft 365 Apps for Enterprise should apply the November 2026 updates to close the exploited NTLMv2 hash-exposure flaw. Because the attack requires a recipient to open a crafted message file, users should treat unexpected attachments with caution until patches are installed.
The takeaway
Applying monthly security updates promptly remains one of the most effective defenses against credential-theft attacks like the Outlook flaw in this release. Organizations that delay patching a large batch such as this one leave a longer window for exploitation.
Further reading
For more on how threats like this are tracked and handled, explore our Cybersecurity coverage.
