Microsoft November 2026 update fixes 1,093 flaws, one Outlook zero-day
Original title: Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities Including Outlook Zero-Day
Opening a crafted file can leak an NTLMv2 hash; the Preview Pane is not an attack vector.
Microsoft’s November 2026 Patch Tuesday fixes 1,093 newly released vulnerabilities across Windows, Office, SQL Server, SharePoint, Exchange, Azure, and developer tools. The release includes 63 critical, 1,029 important, and one moderate issue. CVE-2026-124194, rated Moderate at CVSS 6.5, is confirmed exploited: a crafted message can make Outlook contact an attacker-controlled location without the usual warning and expose an NTLMv2 hash. Microsoft does not name the attackers or victims.
Unconfirmed: Microsoft confirms attacks occurred but does not identify attackers, victims, or scale.
- Elevation of privilege accounts for 535 fixes, and remote code execution for 296.
- Excel has 12 critical fixes, Word four, and PowerPoint one.
- Hyper-V has eight critical privilege-escalation flaws, and Message Queuing five critical code-execution bugs.
- Affected clients are 32-bit and 64-bit Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise.
- CVE-2026-124227 and CVE-2026-124228 are important Outlook code-execution bugs and are not exploited.
Impact: Leaks a user’s NTLMv2 hash for impersonation
| Product | Affected |
|---|---|
| Microsoft Office LTSC 2021 | 32-bit and 64-bit |
| Microsoft Office LTSC 2024 | 32-bit and 64-bit |
| Microsoft 365 Apps for Enterprise | 32-bit and 64-bit |
- 1.Prioritize the applicable Outlook updates because exploitation is already underway.
- 2.Match each vulnerability to deployed products in Microsoft’s Security Update Guide.
- CVEs
- CVE-2026-124194CVE-2026-124227CVE-2026-124228CVE-2026-111309CVE-2026-110068CVE-2026-110043CVE-2026-113825CVE-2026-113859CVE-2026-118207CVE-2026-119958CVE-2026-119990CVE-2026-114160CVE-2026-122194
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-110043+4 related CVEs | Heap buffer overflow in Microsoft Outlook via network | 8.8 group max | — | ||
| CVE-2026-113825 | Race condition RCE in Windows SMB srvnet.sys | 7.5 | — | ||
| CVE-2026-113859 | Use-after-free in Windows TCP/IP over adjacent network | 7.5 | — | ||
| CVE-2026-114160 | Unauthenticated privilege elevation in Azure Managed Grafana | 9.8 | — | ||
| CVE-2026-118207 | Authenticated remote code execution in Exchange Server | 8.8 | — | ||
| CVE-2026-119958 | Unauthenticated remote code execution in Windows LDAP | 9.8 | — | ||
| CVE-2026-119990 | Missing authentication in Azure OpenAI enables privilege elevation | 9.8 | — | ||
| CVE-2026-122194 | Null pointer dereference RCE in Microsoft Defender | 8.8 | — | ||
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEV | KEV |
From the original article
2 min read at cybersecuritynews.com
Microsoft has released its November 2026 Patch Tuesday updates, fixing 1,093 newly released vulnerabilities across Windows, Office, SQL Server, SharePoint, Exchange Server, Azure services, and developer tools. The release includes one actively exploited zero-day in Microsoft Outlook that can leak a user’s NTLMv2 authentication hash to an attacker. This update addresses 63 critical vulnerabilities, 1,029 […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.