Microsoft released its November 2026 security update on November 10, addressing 1,235 vulnerabilities as counted by BleepingComputer’s standard methodology, including one Microsoft Outlook flaw, CVE-2026-124194, that Microsoft says has been actively exploited in the wild. Of the total, 66 are rated Critical, 48 of them remote code execution. It is one of the largest single Patch Tuesday releases on record, arriving one month after October’s 1,411.
CVE-2026-124194 is a spoofing and NTLM credential-disclosure flaw. An unauthenticated attacker sends a specially crafted message file, convinces a user to open it in an affected version of Outlook, and the file causes Outlook to connect to an attacker-controlled network location without showing the usual warning about external content. That connection discloses authentication information, specifically the user’s NTLMv2 hash, which the attacker can relay or crack offline and then use to impersonate the account. Exploitation requires user interaction and network connectivity, and user interaction here means “opened an email,” a skill every security awareness program has already certified.
The volume tells its own story. Roughly 639 of the 1,235 fixes land in Windows components, and Microsoft followed an October release of 1,411 vulnerabilities, a period during which the company has said it is using AI to find and patch flaws. The tooling that was supposed to defend the network has become its most productive bug reporter, and the backlog now grows at a rate no change-advisory board can debate in real time.
For a normal company, nothing about this release is exotic, which is what makes it dangerous. Outlook is the one application on every desk that can trigger the vulnerable code path by receiving mail, so exposure is the entire organization, not a lone sysadmin. There is no server role you can quietly skip this month, and the component that matters arrives uninvited in the inbox, wearing a subject line.
The practical sequence is short. Deploy this week, starting with the exploited zero-day, then the Critical remote-code-execution set, using your normal test rings rather than inventing a new process under pressure. Block outbound SMB, TCP port 445, at the perimeter so workstations cannot authenticate to external shares; it blunts the whole class of NTLM-disclosure attacks whether or not the patch is installed yet. And treat the external-content warning as a hint, not a control: an attacker who removes the warning has not defeated your defenses, they have just made your missing controls visible.
A patched system is like a well-built dam: absolutely nobody writes songs about it. That is the point of both, and it is why Tuesday’s work is thankless, unglamorous, and non-negotiable. Check deployment coverage on Friday, not next month; the number of vulnerabilities is someone else’s record. The number of unpatched ones is yours.
Sources
Original reporting — the facts belong to their owners; the opinions and rodents are ours.