Microsoft November patches fix 1,094 bugs, one exploited
Original title: November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far
CVE-2026-124194 can leak an Outlook user’s NTLMv2 hash; two zero-click remote code execution bugs also ship.
Microsoft’s November updates fix 1,094 bugs. CVE-2026-124194, an Outlook spoofing flaw Microsoft marked exploited, can leak a user’s NTLMv2 hash when a crafted message is opened, without the usual external-content warning. Two critical zero-click issues, CVE-2026-116928 in Windows Search via Exchange and CVE-2026-119958 in LDAP, allow unauthenticated remote code execution. CVE-2026-112967, a heap overflow in Xbox Live Networking Service, is rated 9.8.
Unconfirmed: Microsoft did not identify the attackers, when exploitation started, or how access was used.
- CVE-2026-124194 has a CVSS score of 6.5.
- None of the 1,094 bugs are listed as publicly known before the updates.
- October’s Patch Tuesday fixed 1,474 CVEs.
- Childs counts 30 CVEs with wormable risk and no user interaction.
- Microsoft did not say when exploitation of CVE-2026-124194 began.
Impact: NTLMv2 hash disclosure; other bugs allow unauthenticated remote code execution
| Product | Affected |
|---|---|
| Microsoft Outlook | — |
| Microsoft Windows Search Component | — |
| Microsoft Exchange | — |
| Microsoft Windows LDAP | — |
| Microsoft Xbox Live Networking Service | — |
- 1.Prioritize the fix for exploited Outlook flaw CVE-2026-124194.
- 2.Patch Exchange and domain controllers first to address zero-click remote code execution.
- 3.Ring-fence exposed DNS and DHCP, and watch inboxes for suspicious files.
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-112967 | Heap buffer overflow in Windows Xbox Live Networking Service | 9.8 | — | ||
| CVE-2026-116928 | Out-of-bounds write RCE in Windows Search Component | 9.8 | — | ||
| CVE-2026-119958 | Unauthenticated remote code execution in Windows LDAP | 9.8 | — | ||
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEV | KEV |
From the original article
3 min read at theregister.comIt’s another doozy of a Patch Tuesday, with Microsoft fixing 1,094 bugs in its products, including one that attackers exploited before Redmond released a patch. Jake Knott, head of threat intelligence at exposure management firm watchTowr, succinctly said in an email to The Register : “Maybe we should just go home.”
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.