Microsoft Patch Tuesday fixes Outlook flaw already under attack
Opening a crafted Outlook message can leak an NTLMv2 hash via CVE-2026-124194; a separate Windows Search RCE is not reported as exploited.
Stories per day · 30 days
13 RSS
Relatedmicrosoft45windows26outlook22zero-day13exchange12ntlm11cve-2026-969518cisa-kev6office6remote-code-execution5kev4motw4sharepoint4windows-114active-directory3elevation-of-privilege3ldap3.net3
133 stories, newest first · one card per story
Stories tagged #patch-tuesday
Microsoft releases Windows 10 KB5131096 extended security update
The update reaches build 19045.7846, or 19044.7846 on Enterprise LTSC 2021, and includes November Patch Tuesday fixes.
November 2026 Patch Tuesday lists 1,094 flaws, one exploited
The available text is mostly site navigation and does not name the exploited flaw or affected products.
Microsoft fixes 1235 flaws, including exploited Outlook zero-day
CVE-2026-124194 can leak NTLMv2 hashes from Microsoft 365 Apps and Office LTSC 2021 and 2024 after one opened message file.
Microsoft November patches fix 1,090 flaws, one Outlook bug exploited
CVE-2026-124194 can leak an NTLMv2 hash if a user opens a crafted Outlook file; ZDI flags 30 wormable bugs.
Intel and AMD advisories cover over 200 vulnerabilities
Intel lists three critical issues, including MigTD remote code execution; AMD rates none critical.
Microsoft patches 1,259 flaws, including exploited Outlook bug
Opening a crafted message can leak an NTLMv2 hash without Outlook’s usual warning.
Microsoft November 2026 patches fix 1235 flaws, one exploited in Outlook
CISA added Outlook spoofing flaw CVE-2026-124194 to KEV and set a November 24, 2026 patch deadline.
1
Microsoft November 2026 patches critical RCEs and an exploited Outlook flaw
Only CVE-2026-124194, a moderate Outlook spoofing bug, is marked exploited; builds and fixes are not listed.
1
Microsoft patches nearly 1,100 flaws, including exploited Outlook bug
CVE-2026-124194 is the only flaw Microsoft says is already exploited; 63 of this month's fixes are rated critical.
November Patch Tuesday fixes exploited Outlook NTLM hash-theft flaw
Attackers already use CVE-2026-124194, CVSS 6.5, which leaks an NTLMv2 hash after a user opens a malicious Office file.
2
Microsoft November 2026 patches fix 1095 flaws, one exploited
Only CVE-2026-124194, an Outlook spoofing bug scored 6.5, is exploited; 48 of 64 critical issues are remote code execution.
2
Microsoft November patches fix 1,094 bugs, one exploited
CVE-2026-124194 can leak an Outlook user’s NTLMv2 hash; two zero-click remote code execution bugs also ship.
Microsoft November patches include exploited Outlook flaw CVE-2026-124194
The release covers 1,093 flaws, 63 rated critical, plus Exchange, SharePoint, Windows Search, and LDAP bugs.
November 2026 Patch Tuesday lists dozens of Microsoft flaws
The excerpt lists 57 CVEs, including CVSS 9.8 remote code execution bugs rated exploitation less likely.
Microsoft November 2026 Patch Tuesday covers dozens of Windows flaws
The visible Rapid7 list includes several 9.8 remote code execution bugs; each entry is marked not publicly disclosed.
Microsoft November patches list 1,094 CVEs; one Outlook flaw exploited
CISA added the exploited Outlook spoofing bug to KEV; a Windows Search flaw is called zero-click code execution.
Microsoft Patch Tuesday discloses 1,093 bugs, including exploited Outlook flaw
CISA ordered agencies to patch exploited Outlook, Barracuda and other bugs, with Outlook due by month’s end.
Microsoft November patches cover 1,260 flaws, one Outlook bug exploited
SANS says 68 issues are critical and CVE-2026-124194, an Outlook spoofing bug, is already exploited.
November Patch Tuesday fixes 1,235 flaws and an Outlook zero-day
Opening a crafted Outlook message can leak an NTLMv2 hash to an attacker-controlled share.
1
ZDI lists November 2026 Microsoft fixes, one Outlook bug exploited
CVE-2026-124194 is the only listed flaw marked exploited; it is a Moderate CVSS 6.5 spoofing bug.
Microsoft November 2026 update fixes 1,093 flaws, one Outlook zero-day
Opening a crafted file can leak an NTLMv2 hash; the Preview Pane is not an attack vector.
Microsoft November 2026 Patch Tuesday fixes 1093 CVEs, one exploited
Outlook spoofing CVE-2026-124194, used as a zero-day, leaks NTLMv2 hashes when a crafted Office file is opened.
1
Microsoft releases November 2026 Windows 11 cumulative updates
The mandatory packages cover hundreds of previously found flaws plus File Explorer, AutoPlay, Magnifier, and taskbar changes.
1