Microsoft fixes 1235 flaws, including exploited Outlook zero-day
Original title: Microsoft Fixes 1235 Flaws in Another Record Patch Tuesday
CVE-2026-124194 can leak NTLMv2 hashes from Microsoft 365 Apps and Office LTSC 2021 and 2024 after one opened message file.
Microsoft's November Patch Tuesday fixes 1235 vulnerabilities, its fourth record patch month this year after July, September and October. One zero-day, CVE-2026-124194, is already exploited: a crafted message file opened in Outlook connects to an attacker-controlled location without the usual external-content warning and can leak an NTLMv2 hash. It is rated moderate and affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. SAP's November Patch Day addressed 43 issues, including four CVSS 10.0 flaws.
Unconfirmed: The article does not say how widely the Outlook zero-day has been exploited.
- 536 Microsoft fixes are elevation of privilege, 296 remote code execution and 157 information disclosure.
- 66 Microsoft CVEs are rated critical, most of them remote code execution.
- SAP issued 12 Hot News Notes and 13 High Priority Notes, twice its 2026 average.
- Four SAP flaws scored CVSS 10.0, including ProxyGate broken access control in SAP Gateway.
Impact: Leaks a user's NTLMv2 hash for sign-in as that person
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Outlook | Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 | — |
| SAP Gateway | — | SAP Security Note #3798345 |
| SAP NetWeaver AS ABAP (Internet Communication Manager) | — | SAP Security Note #3778530 |
| SAP Web Dispatcher | — | SAP Security Note #3778556 |
| SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) | — | SAP Security Note #3849308 |
- 1.Push the Office update to every Outlook user, starting with administrators and high-value accounts.
- 2.Apply the SAP Hot News Notes for the four CVSS 10.0 vulnerabilities.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-120017 | Authentication bypass in SAP NetWeaver AS ABAP under some configs | 10.0 | — | ||
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEVPoC | KEV |
| CVE-2026-76964 | Unauthenticated memory corruption RCE in SAP NetWeaver AS ABAP | 10.0 | — | ||
| CVE-2026-89103 | Incorrect authorization via SAP Gateway default ACL | 10.0 | — | ||
| CVE-2026-89126 | Unauthenticated memory corruption in SAP Web Dispatcher | 10.0 | — |
From the original article
2 min read at infosecurity-magazine.com
Microsoft patched a record-breaking 1235 CVEs in November’s Patch Tuesday
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.