Microsoft's November 2026 security update fixes a flaw in classic Outlook that attackers are already using to steal Windows login material. Tracked as CVE-2026-124194, the bug lets a booby-trapped message file make Outlook quietly connect to a server the attacker controls, handing over the victim's NTLMv2 hash without the external-content warning users would normally see.
It is the only vulnerability Microsoft lists as exploited in the wild this month, inside a release so large that researchers do not agree on a headline count. CrowdStrike's Falcon Exposure Management team tallies 1,252 CVEs, 68 of them Critical. Cisco Talos counts 1,095 vulnerabilities with 64 rated critical, and Rapid7's Adam Barnett counts 1,092 Microsoft own-product vulnerabilities. Microsoft's own release notes carry the full list. Last month's update also shipped with an exploited bug, a Windows Shell flaw.
A 6.5 score that undersells a login leak
Microsoft rates CVE-2026-124194 a Moderate spoofing vulnerability with a CVSS score of 6.5. The victim has to open the malicious file, and both CrowdStrike and Rapid7 point out that the Preview Pane is not an attack vector for this bug. Once the file is opened, though, Outlook reaches out silently and leaks the user's NTLMv2 hash, a scrambled form of their Windows credential.
Rapid7 explains why that matters more than the score suggests. The hash can be relayed live to impersonate the user against other services that lack safeguards such as SMB or LDAP signing, or Extended Protection for Authentication on Exchange and Active Directory Certificate Services. A motivated attacker can also crack it offline to recover the password. Rapid7 adds that the flaw is useful both to commodity crews harvesting initial access at scale and to more targeted operators. All supported versions of classic Outlook receive patches.
Pre-auth bugs in TLS, Active Directory and Exchange indexing
Talos lists the bugs Microsoft considers more likely to be exploited. CVE-2026-119952 in Windows Schannel, Microsoft's implementation of TLS, is a pre-authentication remote code execution flaw rated CVSS 8.1; Rapid7 notes the advisory says specific conditions are required, yet Microsoft still rates exploitation more likely. CVE-2026-118146 (CVSS 8.8, code execution) and CVE-2026-118148 (CVSS 7.5, privilege escalation) affect Active Directory Domain Services, and CrowdStrike warns that flaws in these identity services can cascade to domain-wide compromise. CVE-2026-118207 in Exchange Server (CVSS 8.8) and CVE-2026-113862 in Windows Network Address Translation (CVSS 8.1) complete that list.
Two Critical bugs carry CVSS 9.8. CVE-2026-116928 in the Windows Search component can give an attacker code execution on an Exchange server, Rapid7 says, by sending a malicious attachment that Exchange processes automatically as Windows Search indexes mail. The fix ships in Windows, not Exchange. CVE-2026-112967 is a heap-based buffer overflow in the Windows Xbox Live Networking Service; CrowdStrike notes enterprise exposure depends on whether that service is present and running.
Outlook also takes several preview-triggered fixes. CrowdStrike says that for CVE-2026-110043 and CVE-2026-110068 (each CVSS 8.8 per Talos), merely selecting a malicious message in the Reading Pane triggers code execution, the third straight month this pattern has dominated. Windows Hyper-V receives eight privilege escalation fixes, including CVE-2026-113753 (CVSS 8.2).
Patch classic Outlook first, then close NTLM relay paths
- Prioritise the November update on machines running classic Outlook, since CVE-2026-124194 is under active exploitation.
- Patch the Windows hosts under Exchange for CVE-2026-116928. Rapid7 notes that only Exchange Subscription Edition remains supported.
- Update domain controllers for the Active Directory Domain Services fixes.
- Enforce SMB and LDAP signing and Extended Protection for Authentication on Exchange and AD CS to blunt hash relay, as Rapid7 recommends.
- Check any system with Windows Message Queuing (MSMQ) enabled; CrowdStrike flags CVE-2026-109459 and CVE-2026-116710 among 14 unauthenticated network-reachable RCE bugs this month.
Rapid7 also reminds administrators that as of November 11, 2026, .NET 8 LTS, PowerShell 7.4 LTS and the 23H2 Enterprise, Education and IoT editions of Windows 11 pass their end dates. The month's one confirmed attack does not need a critical bug at all: a mid-rated warning bypass that leaks a reusable credential is often all an intruder needs to walk in.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.