Microsoft’s November 2026 Patch Tuesday fixes an Outlook flaw, CVE-2026-124194, that attackers were already abusing before a patch existed. Opening a malicious message file can make Outlook quietly contact an attacker’s server and expose the user’s NTLMv2 password hash. The fix arrives through Office updates rather than the Windows cumulative update, so patching Windows alone leaves Outlook exposed.
What happened
Microsoft shipped its November security updates on November 10. Counts differ by method: Tenable tallies 1,093 CVEs, 63 of them critical; SecurityWeek counts 1,094; BleepingComputer reports 1,235, a figure that by its own breakdown includes 142 Edge (Chromium) entries. Only one flaw is marked as exploited, and none were publicly known before the fix, according to Dustin Childs of TrendAI’s Zero Day Initiative (ZDI).
The exploited bug is an Outlook spoofing vulnerability rated Moderate, with a CVSS score of 6.5. An attacker sends a crafted message file and persuades the target to open it in a vulnerable Outlook. Outlook then connects to an attacker-controlled network location without showing its usual external-content warning, which discloses the user’s NTLMv2 hash. The Preview Pane is not an attack path, so the file has to be opened. SecurityWeek reports that Microsoft lists Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 as affected.
Microsoft’s advisory credits a researcher using the handle nono and Benoît Sevens. SecurityWeek reports that Sevens’ acknowledgment mentions using Anthropic’s Claude AI model, and Tenable likewise notes that the advisory credits a researcher who used Claude.
Why it matters
The Moderate label undersells the risk. ZDI says an attacker can use the captured hash to authenticate as the user. SOCRadar adds that the hash can be relayed to internal services that accept NTLM without signing protections, or cracked offline if the password is weak. SOCRadar and T-Break both report that CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10, with a November 24 deadline for federal civilian agencies.
The same release carries fixes that ZDI ranks high for defenders. One is a Windows Search flaw reachable through Exchange (CVE-2026-116928, CVSS 9.8) that can run code when a malicious attachment is indexed, with no click from the recipient. Another is an LDAP flaw (CVE-2026-119958, CVSS 9.8) that ZDI says is especially dangerous on domain controllers. ZDI counts about 30 flaws it considers wormable this month.
What to do
Steps 1 to 4 follow reporting from T-Break, SOCRadar and ZDI. Steps 5 and 6 are our analysis, general hardening advice rather than vendor guidance.
- Update Microsoft 365 Apps or Office LTSC now. In Outlook or Word, go to File, Account, Update Options, then Update Now. If that button is missing, your organization manages updates and its administrators need to push the Office update.
- Confirm the result. In Outlook, File, Office Account, About Outlook shows the installed build, which you can compare with the fixed builds listed in Microsoft’s advisory for
CVE-2026-124194. - Install the November Windows updates too, but do not count on them to fix Outlook. SOCRadar and T-Break both say the Outlook fix is not in the Windows cumulative update (KB5132061).
- Among the other fixes, ZDI advises patching Exchange servers and domain controllers first, and fencing off exposed network services such as DNS and DHCP.
- Until Outlook is patched, tell staff not to open unexpected message files or attachments, even from familiar senders.
- Block outbound SMB (TCP 445) to the internet at the network edge, enforce SMB and LDAP signing with Extended Protection for Authentication, and watch authentication logs for unusual NTLM activity tied to Outlook users.
What we still do not know
- Who is exploiting the flaw, since when, and against which targets. Microsoft’s advisory does not say, according to SecurityWeek and The Register.
- How quickly others will copy the technique. The Register expects attackers to start reverse-engineering the patch now that it is public; that is its assessment, not a confirmed observation.
- CISA’s listing details. We could not open CISA’s catalog directly, so the November 24 deadline rests on the SOCRadar and T-Break reports.
- The exact size of the release, since outlets count the CVEs differently.
Sources: SecurityWeek (Nov 10, 2026); Zero Day Initiative (Nov 10, 2026); The Register (Nov 10, 2026); Tenable (Nov 10, 2026); BleepingComputer (Nov 10, 2026); SOCRadar (Nov 11, 2026); T-Break (Nov 11, 2026).
Leave a Reply