Microsoft's November Patch Tuesday: 1,259 Fixes and One Exploited Outlook Flaw

Microsoft's November 2026 Patch Tuesday is another very large release: the company shipped fixes for 1,259 vulnerabilities across its product portfolio, the second consecutive month in which the patch count has passed 1,000 ^¹. The bulk of the work lands in Windows, with 726 flaws, followed by 174 in Office, 61 and 53 in two separate Developer Tools categories, 59 in SQL Server, and 27 in SharePoint Server. The release also incorporates 165 CVE identifiers issued by organizations other than Microsoft. By flaw type, more than 500 of the entries involve elevation of privilege, with remote code execution and information disclosure making up much of the remainder.

The volume is striking on its own. According to Satnam Narang, senior staff research engineer at Tenable, this round pushes Microsoft past 5,100 CVEs addressed in 2026 alone. But the number that matters most for most users is one.

The Outlook zero-day

The single actively exploited flaw in the batch is tracked as CVE-2026-124194, a Microsoft Outlook vulnerability with a CVSS score of 6.5 that Microsoft classifies as a spoofing issue. In its advisory, Microsoft describes the root cause as Outlook's product UI failing to warn users about unsafe actions, which allows an unauthenticated attacker to perform spoofing over a network.

The attack chain is simple and depends on a person, not a misconfiguration. An attacker sends a specially crafted message file and persuades the target to open it in an affected Outlook version. When opened, Outlook connects to an attacker-controlled network location without showing the usual external-content warning. That connection can disclose authentication information, including an NTLMv2 hash, which an attacker could then use to impersonate the user.

Two conditions limit exploitation: network connectivity and user interaction are both required, so merely receiving the file is not enough. Microsoft has not disclosed when the attacks began or who is behind them, and the sources reviewed for this article do not identify the threat actors.

Why a 6.5 score is misleading

The moderate severity rating has drawn pushback from researchers who argue the label undersells the risk. Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative, put it plainly in his monthly Patch Tuesday review: the flaw "is labeled spoofing, but the impact is bigger than the name suggests" ^². His reasoning matches the technical description — a stolen NTLMv2 hash can be cracked offline or relayed to authenticate as the victim, which is a far more serious outcome than the word "spoofing" implies.

That distinction matters for anyone deciding how to sequence updates. A 6.5 score might suggest the fix can wait behind higher-rated items; active exploitation and credential theft argue the opposite, particularly in organizations that rely on Windows authentication. The Windows Report coverage of the release makes the same point, noting the flaw is especially concerning for environments built around Windows authentication ^³.

The wider context

This month's release is not arriving in a quiet period. Jake Knott, head of threat intelligence at exposure management firm watchTowr, told The Register that most security teams have not recovered from the previous month of critical vulnerabilities and emergency patches. The November batch's single zero-day is relatively restrained compared with that backdrop, but the sheer volume of fixes means administrators still face a long triage list.

For consumers and small businesses, the practical takeaway is narrow and immediate: apply the Outlook update rather than waiting for a maintenance window, and treat unexpected message files from unknown senders with suspicion, since the exploit requires the recipient to open the file. For IT teams, the broader batch deserves its usual prioritization pass, with the Outlook flaw placed at the top regardless of its CVSS number.

What remains unclear is the scale of exploitation so far. Microsoft has confirmed the flaw was exploited in the wild but has not published attack details, and none of the sources reviewed here establish how many users or organizations were affected. Until that information appears, the safest reading is the one researchers are pushing: patch first, ask questions later.

Sources

1. ¹ Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes thehackernews.com
2. ² November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far www.theregister.com
3. ³ Microsoft's November 2026 Patch Tuesday Updates Fixes 1200+ Vulnerabilities, Including Exploited Outlook Zero-Day windowsreport.com