November Patch Tuesday fixes exploited Outlook NTLM hash-theft flaw
Original title: November 2026 Patch Tuesday: 63 Critical Microsoft fixes, plus an Outlook zero day that allows theft of hashed credentials
Attackers already use CVE-2026-124194, CVSS 6.5, which leaks an NTLMv2 hash after a user opens a malicious Office file.
Microsoft’s November Patch Tuesday fixes 1,094 vulnerabilities, 63 rated critical, including an actively attacked Outlook flaw that can disclose a user’s NTLMv2 password hash. Opening a malicious Office file can make Outlook connect to an attacker-controlled location without the usual external-content warning. Four other flaws score 9.8, including unauthenticated Windows LDAP code execution and Exchange code execution triggered by email. SAP also patched critical WebSocket memory-corruption issues dubbed ICM2Shell, rated CVSS 10.
Unconfirmed: The SAP section is cut off, so fixed versions and exploitation status for ICM2Shell are not stated.
- Affected Microsoft products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.
- CVE-2026-119958, CVE-2026-118207, and CVE-2026-112967 need no credentials and no user action.
- Azure OpenAI elevation flaw CVE-2026-119990 is automatically patched by Microsoft.
- ICM2Shell covers CVE-2026-76964 and CVE-2026-89126 in SAP ICM and Web Dispatcher.
- Microsoft credited an Anthropic researcher using Claude with finding the Outlook flaw.
Impact: Disclosure of NTLMv2 hashes that can be relayed or cracked
| Product | Affected |
|---|---|
| Microsoft Outlook | — |
| Microsoft 365 Apps for Enterprise | — |
| Microsoft Office LTSC | 2021 and 2024 |
| SAP Internet Communications Manager | — |
| SAP Web Dispatcher | — |
- 1.Install the November updates for affected Outlook and Office products immediately.
- 2.Patch domain controllers and Exchange servers before other Microsoft systems.
- 3.Inventory Message Queuing, disable it where unused, and patch remaining servers.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-112967 | Heap buffer overflow in Windows Xbox Live Networking Service | 9.8 | — | ||
| CVE-2026-118207 | Authenticated remote code execution in Exchange Server | 8.8 | — | ||
| CVE-2026-119958 | Unauthenticated remote code execution in Windows LDAP | 9.8 | — | ||
| CVE-2026-119990 | Missing authentication in Azure OpenAI enables privilege elevation | 9.8 | — | ||
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEVPoC | KEV |
| CVE-2026-76964 | Unauthenticated memory corruption RCE in SAP NetWeaver AS ABAP | 10.0 | — | ||
| CVE-2026-89126 | Unauthenticated memory corruption in SAP Web Dispatcher | 10.0 | — |
From the original article
6 min read at csoonline.com
A currently exploited zero-day vulnerability that can let attackers steal hashed Outlook NTLM credentials is among the 1,094 holes Microsoft fixed in its November Patch Tuesday releases. Although rated as only moderate in severity, with a CVSS score of 6. 5, Windows administrators need to address CVE-2026-124194 immediately because threat actors are already attacking it.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.