Microsoft November patches fix 1,090 flaws, one Outlook bug exploited
Original title: Microsoft November Patch Tuesday: one exploited Outlook bug and 30 wormable flaws
CVE-2026-124194 can leak an NTLMv2 hash if a user opens a crafted Outlook file; ZDI flags 30 wormable bugs.
Microsoft’s November Patch Tuesday fixes about 1,090 vulnerabilities across Windows, Office, Exchange, Azure and other components, fewer than roughly 1,400 last month. Only CVE-2026-124194, an Outlook spoofing bug, is under active attack; none is publicly known. Opening a crafted message can make Outlook connect to an attacker-controlled location without the external-content warning and disclose an NTLMv2 hash. ZDI also highlights zero-click Exchange indexing RCE and unauthenticated LDAP, Schannel and other network bugs.
Unconfirmed: ZDI says its wormable count may be wrong because some advisories lack detail, and other trackers report different totals.
- CVE-2026-124194 scores CVSS 6.5; Preview Pane is not an attack path.
- CVE-2026-116928 is zero-click Exchange indexing RCE scored CVSS 9.8.
- CVE-2026-119958 is unauthenticated LDAP out-of-bounds write on domain controllers.
- ZDI counts 30 wormable bugs, down from 59 last month.
- Azure OpenAI CVE-2026-119990 was revised to need no customer action.
Impact: NTLMv2 hash theft and remote code execution
| Product | Affected |
|---|---|
| Microsoft Outlook | affected version of Microsoft Outlook |
| Microsoft Exchange Server | — |
| Microsoft Windows LDAP | — |
| Microsoft Schannel | — |
| Microsoft Azure OpenAI | — |
- 1.Test and deploy patches quickly for DNS, DHCP, LDAP and Exchange.
- 2.Prioritize the exploited Outlook bug Microsoft marks as attacked.
- CVEs
- CVE-2026-124194CVE-2026-116928CVE-2026-119958CVE-2026-119952CVE-2026-119990CVE-2026-95962CVE-2026-112967CVE-2026-116710CVE-2026-81384CVE-2026-96067CVE-2026-88243CVE-2026-95882
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-112967 | Heap buffer overflow in Windows Xbox Live Networking Service | 9.8 | — | ||
| CVE-2026-116710 | Heap overflow in Windows Message Queuing (unauthenticated network) | 8.1 | — | ||
| CVE-2026-116928 | Out-of-bounds write RCE in Windows Search Component | 9.8 | — | ||
| CVE-2026-119952 | Timing discrepancy enabling network RCE in Windows Schannel | 8.1 | — | ||
| CVE-2026-119958 | Unauthenticated remote code execution in Windows LDAP | 9.8 | — | ||
| CVE-2026-119990 | Missing authentication in Azure OpenAI enables privilege elevation | 9.8 | — | ||
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEVPoC | KEV |
| CVE-2026-81384 | Heap buffer overflow in Microsoft DNS Server | 8.1 | — | ||
| CVE-2026-88243 | Out-of-bounds read to RCE in Windows DHCP Server | 9.8 | — | ||
| CVE-2026-95882 | Network stack buffer overflow in Windows DirectMusic | 9.8 | — | ||
| CVE-2026-95962 | Use-after-free RCE in Windows Virtual Filtering Platform | 9.0 | — | ||
| CVE-2026-96067 | Unauthenticated network RCE via integer overflow in Microsoft Color Management | 9.8 | — |
From the original article
3 min read at securityaffairs.com
Microsoft November Patch Tuesday security updates fix 1,090 flaws, including one exploited Outlook bug and 30 potentially wormable issues. Microsoft November Patch Tuesday addressed about 1,090 new vulnerabilities, which is less than the roughly 1,400 last month. Two months in a row now exceed every previous year from Microsoft, and the overall count is a […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.