November Patch Tuesday fixes 1,095 flaws; Outlook bug exploited
Original title: Never be afraid to ask questions
Outlook CVE-2026-124194 and Chrome CVE-2026-125350 have in-the-wild exploits; 48 critical bugs allow remote code execution.
Cisco Talos says Microsoft's November 2026 Patch Tuesday addresses 1,095 vulnerabilities, including 64 critical flaws, 48 of which could allow remote code execution. Microsoft warned that Outlook spoofing flaw CVE-2026-124194 is already exploited. Google patched a Chrome XML use-after-free, CVE-2026-125350, and confirmed an in-the-wild exploit that could run code in the sandbox from crafted HTML. Talos urges teams to patch those issues and critical RCEs in Exchange and Active Directory first, and to deploy new Snort rules. The newsletter also cites separate reports on Barracuda, N-able, UK government code, and Japanese cybersecurity funding.
Unconfirmed: The Barracuda, N-able, UK government, and Japan items are cited from other outlets and are not detailed here.
- Patch Tuesday covers 1,095 vulnerabilities and 64 critical flaws.
- Forty-eight of the critical flaws could allow remote code execution.
- CVE-2026-124194 is an Outlook spoofing flaw already exploited.
- Chrome CVE-2026-125350 is a use-after-free with a confirmed exploit.
- Talos points administrators to a new suite of Snort rules.
Impact: Outlook spoofing and Chrome sandbox code execution
| Product | Affected |
|---|---|
| Microsoft Office Outlook | — |
| Google Chrome | — |
- 1.Patch Outlook CVE-2026-124194, the Chrome XML flaw, and critical RCEs in Exchange and Active Directory first.
- 2.Deploy the new Snort rules from the Talos post while patching continues.
- Organizations
- Cisco Talos
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | 2% | KEVPoC | KEV |
| CVE-2026-125350 | Use-after-free in Chrome XML before 157.0.8103.50 | 8.8 | <1% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 1fd9ccecac8794f39d826fdd8a62e6bc | 89d7b22db5dc65cd0b2ff68b20b74863d44f53fd346de739081694 MD5: 1fd9ccecac8794f39d826fdd8a62e6bc Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | 485055033bcddfde56325c0d2feea4f2 | 2218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9 MD5: 485055033bcddfde56325c0d2feea4f2 Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | 57ddcd4384fd595a12df5a6258e5af4d | 5db100de257e6c8a4c85b08a30fd9591de754169adcfe0cf627bcb MD5: 57ddcd4384fd595a12df5a6258e5af4d Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | 95a6a4b638cfdfbe3afc883d593a1f87 | 9faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85 MD5: 95a6a4b638cfdfbe3afc883d593a1f87 Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | cca616647db9370c88998ae25da6997f | 6bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f MD5: cca616647db9370c88998ae25da6997f Talos Rep: https://talosintelligence.com/talos_file_reputat |
| sha256 | 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f | c81df85.js Detection Name: W32.F4B1F888F2-95.SBX.TG SHA256: 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f MD5: cca616647db9370c88998ae25da6997f Talos Rep: https://ta |
| sha256 | 985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9 | 1b5ab.html Detection Name: W32.F0F8CEED9D-95.SBX.TG SHA256: 985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9 MD5: 485055033bcddfde56325c0d2feea4f2 Talos Rep: https://ta |
| sha256 | ae59aedc4d89d7b22db5dc65cd0b2ff68b20b74863d44f53fd346de739081694 | 5da6997f.exe Detection Name: Win.Tool.Kmsauto::1201 SHA256: ae59aedc4d89d7b22db5dc65cd0b2ff68b20b74863d44f53fd346de739081694 MD5: 1fd9ccecac8794f39d826fdd8a62e6bc Talos Rep: https://ta |
| sha256 | f0f8ceed9d5db100de257e6c8a4c85b08a30fd9591de754169adcfe0cf627bcb | 081694.exe Detection Name: W32.AE59AEDC4D-95.SBX.TG SHA256: f0f8ceed9d5db100de257e6c8a4c85b08a30fd9591de754169adcfe0cf627bcb MD5: 57ddcd4384fd595a12df5a6258e5af4d Talos Rep: https://ta |
| sha256 | f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85 | lware files from Talos telemetry over the past week SHA256: f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85 MD5: 95a6a4b638cfdfbe3afc883d593a1f87 Talos Rep: https://ta |
From the original article
5 min read at blog.talosintelligence.com
Amy reflects on a formative college anthropology course that taught her the power of asking questions to bridge cultural gaps.
By Amy Ciminnisi · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.