Microsoft’s November 2026 Patch Tuesday rollout patches an alarming 1,093 new security flaws across its product line. Among these is an Outlook zero-day that’s already being exploited in the wild. With updates delivered today for Windows, Office, SQL Server, SharePoint and more, the release includes 63 critical, 1,029 important, and one moderate-severity vulnerabilities. Exposed flaws range from remote code execution to tampering and spoofing. (Total vulnerabilities: 1,093.)
Outlook Zero-Day: NTLMv2 Hash Leakage
The exposed Outlook vulnerability, CVE-2026-124194, enables attackers to steal a user’s NTLMv2 authentication hash. Despite its “Moderate” severity and CVSS score of 6.5, Microsoft confirms it is already actively exploited. The weakness stems from missing warnings when opening unsafe content (classified under CWE-356). An attacker can send a crafted message file; if opened and network access is available, Outlook may connect to an attacker-controlled location without showing external content warnings, thus exposing credentials.
Affected products include both 32- and 64-bit versions of Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. Even though preview panes do not trigger the exploit, users are urged to apply updates immediately, especially since exploitation is underway.
Other Critical Fixes to Prioritize
Alongside Outlook, Microsoft patched several high-risk vulnerabilities in both Windows and Office. Highlights include two remote code execution flaws in Windows Network Connected Devices Auto-Setup Service (CVE-2026-125136) and Function Discovery Resource Publication (CVE-2026-125134), plus an elevation of privilege bug in the Graphics Kernel (CVE-2026-125137). None of these three were publicly disclosed or actively exploited at release.
Office apps also received forced updates addressing remote code execution vulnerabilities, such as issues in Word (CVE-2026-124185) and Excel (CVE-2026-124170). Patches were also issued for infrastructure-level components like DNS (CVE-2026-96177), DHCP, Hyper-V, and Remote Desktop.
Severity Isn’t the Whole Picture
The outlook zero-day, despite a “Moderate” rating, illustrates how exploitation status can override technical severity. Microsoft’s own guidance emphasizes consulting its Security Update Guide to map vulnerabilities to deployed products rather than assuming blanket exposure. Organizations are encouraged to give priority to flaws already under attack, even if their severity label isn’t “Critical.”
THIS MEANS: Teams that manage patching, from IT Ops to Security Operations Centers (SOCs), must integrate threat intelligence indicating active exploitation alongside severity ratings when triaging vulnerabilities.
What to Do Now
- Patch immediately—especially Outlook and Office LTSC users exposed to the zero-day.
- Scan your environment for Windows components running services like Function Discovery or DNS and Remote Desktop—apply the corresponding updates.
- Review your threat intelligence tools and prioritize vulnerabilities based on real-world exploitation, not just severity.
Background: Patch Tuesday is Microsoft’s regularly scheduled security update mechanism, typically involving two dozen to more than a hundred fixes. Monthly updates aim to close exposures before attackers can exploit them; this month’s sheer volume and the inclusion of an already exploited Outlook flaw make it especially critical.
Analytically, this patch release underscores how rapidly attackers can weaponize even “Moderate” vulnerabilities when they involve credentials or authentication bypasses. What matters now is not just how bad a flaw is—on paper—but whether it’s being used. Security teams should adjust their risk models accordingly, giving weight to active exploitation and exposure surface. As Microsoft continues to tie multiple critical fixes to emerging threats across its ecosystem, time to patch becomes less of a nice-to-have and more of an operational imperative.
