Microsoft patches 1,259 flaws, including exploited Outlook bug
Original title: Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes
Opening a crafted message can leak an NTLMv2 hash without Outlook’s usual warning.
Microsoft released fixes for 1,259 vulnerabilities, including 726 in Windows and 174 in Office, plus 165 non-Microsoft CVE identifiers. More than 500 are elevation-of-privilege issues. Moderate Outlook flaw CVE-2026-124194, scored 6.5, is actively exploited: a crafted message can make Outlook connect to an attacker-controlled location and disclose an NTLMv2 hash. CISA added it to the KEV catalog. Microsoft has not named an actor.
Unconfirmed: Microsoft has not attributed the attacks or said whether discovery preceded exploitation.
- Federal agencies must apply the Outlook fix by November 24, 2026.
- Exploitation requires the user to open the file and have network connectivity.
- Tenable says Microsoft has addressed over 5,100 CVEs this year.
- Noted issues include RCE in Windows Search, LDAP, and Schannel.
- A privilege-escalation flaw in Azure OpenAI is CVE-2026-119990.
Impact: NTLMv2 hash disclosure that could impersonate the user
| Product | Affected |
|---|---|
| Microsoft Outlook | — |
- 1.Apply Microsoft’s Outlook fix; federal agencies must do so by November 24, 2026.
- 2.Prioritize already exploited issues before the rest of this patch set.
- CVEs
- CVE-2026-124194CVE-2026-116928CVE-2026-119958CVE-2026-119952CVE-2026-95962CVE-2026-112967CVE-2026-119990
- Vendors
- Microsoft
- Products
- OutlookWindowsOfficeAzure OpenAI
- Countries
- United States
- AI models
- Claude
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-112967 | Heap buffer overflow in Windows Xbox Live Networking Service | 9.8 | — | ||
| CVE-2026-116928 | Out-of-bounds write RCE in Windows Search Component | 9.8 | — | ||
| CVE-2026-119952 | Timing discrepancy enabling network RCE in Windows Schannel | 8.1 | — | ||
| CVE-2026-119958 | Unauthenticated remote code execution in Windows LDAP | 9.8 | — | ||
| CVE-2026-119990 | Missing authentication in Azure OpenAI enables privilege elevation | 9.8 | — | ||
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEVPoC | KEV |
| CVE-2026-95962 | Use-after-free RCE in Windows Virtual Filtering Platform | 9.0 | — |
From the original article
3 min read at thehackernews.com
Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.