Microsoft November patches include exploited Outlook flaw CVE-2026-124194
Original title: November Patch Tuesday: An Overflowing Cornucopia of CVEs
The release covers 1,093 flaws, 63 rated critical, plus Exchange, SharePoint, Windows Search, and LDAP bugs.
Microsoft's November Patch Tuesday fixed 1,093 vulnerabilities, 63 rated critical. CVE-2026-124194, a CVSS 6.5 Outlook spoofing bug, is confirmed under active exploit and can disclose an NTLMv2 hash if a user opens a malicious Office file. The hash may be relayed to sign in as the user or cracked for the password. The report also flags critical Exchange, SharePoint, Windows Search, and LDAP issues.
Unconfirmed: The excerpt does not name fixed builds or confirm exploitation of the other critical bugs.
- This is Microsoft's second four-digit Patch Tuesday in a row.
- CVE-2026-124194 does not allow code execution and is rated moderate.
- Exploitation requires the target to open a malicious Office file.
- Captured NTLMv2 hashes can be relayed or cracked.
- Watchtowr advises fixing internet-exposed and already exploited bugs first.
Impact: disclosure of an Outlook account's NTLMv2 hash
| Product | Affected |
|---|---|
| Microsoft Outlook | — |
| Microsoft Exchange | — |
| Microsoft SharePoint | — |
| Microsoft Windows Search | — |
- 1.Prioritize the actively exploited Outlook flaw CVE-2026-124194.
- 2.Patch internet-exposed systems before other November updates.
- 3.Check whether the vulnerable component is actually in use.
- CVEs
- CVE-2026-124194
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 42a3f64a30a24172cce0776514fc74fd | ntel-memory-encryption#recipe=similar-items&sourcecontentid=42a3f64a30a24172cce0776514fc74fd) Cheap Hardware Module Bypasses AMD, Intel Memory Encrypti |
| md5 | 702db0764759bac97311f549d13e93a6 | erabilities-2-critical#recipe=similar-items&sourcecontentid=702db0764759bac97311f549d13e93a6) Cisco Drops 48 New Firewall Vulnerabilities, 2 Critical b |
| md5 | 7b70e2514592f68b16486d247d566d50 | itical-zero-click-bugs#recipe=similar-items&sourcecontentid=7b70e2514592f68b16486d247d566d50) Patch Now: Microsoft Flags Zero-Day & Critical Zero-Click |
| md5 | b45e4d720372600e0a70ab73c1dcc203 | ange-zero-day-no-patch#recipe=similar-items&sourcecontentid=b45e4d720372600e0a70ab73c1dcc203) Microsoft Exchange Zero-Day Under Attack, No Patch Availa |
From the original article
9 min read at darkreading.com
Microsoft serves up an actively exploited Outlook zero-day, and a wave of critical Exchange, SharePoint, Windows Search, and LDAP bugs that exhausted defenders need to prioritize fast.
By Tara Seals · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.