November Patch Tuesday fixes 1,235 flaws and an Outlook zero-day
Original title: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
Opening a crafted Outlook message can leak an NTLMv2 hash to an attacker-controlled share.
BleepingComputer reports Microsoft's November 2026 Patch Tuesday fixes 1,235 flaws, including 66 rated Critical, of which 48 are remote code execution. The count excludes 108 flaws fixed earlier in the month. One fix is an actively exploited Outlook spoofing zero-day: an unauthenticated attacker can send a crafted message file that, if opened, makes Outlook connect to an attacker-controlled location without the usual external-content warning and can disclose NTLM authentication data. Microsoft says exploitation needs network connectivity and user interaction.
Unconfirmed: The excerpt describes the exploited Outlook flaw but does not give its CVE identifier.
- About 639 of the 1,235 flaws fall under Windows or Windows components.
- The excluded earlier fixes include one Entra, 82 Mariner, and 25 Edge flaws.
- Captured NTLMv2 hashes can be cracked offline and reused, Microsoft's description implies.
- BleepingComputer says October's updates covered 1,411 flaws.
Impact: Disclosure of NTLMv2 hashes that can impersonate the user
| Product | Affected |
|---|---|
| Microsoft Outlook | affected version |
- 1.Install Microsoft's November 2026 Patch Tuesday updates.
- Vendors
- Microsoft
From the original article
11 min read at bleepingcomputer.com
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.