Microsoft released its November 2026 Patch Tuesday security updates, addressing a massive total of 1,235 vulnerabilities across its product catalog. The massive release contains fixes for 66 Critical flaws and addresses an actively exploited zero-day vulnerability in Microsoft Outlook that enables attackers to harvest corporate credentials.

The monthly update follows an earlier peak in October, which saw 1,411 vulnerabilities addressed as Microsoft continues utilizing artificial intelligence systems to discover and remediate security bugs. According to reporting by BleepingComputer, the November figure excludes 108 flaws fixed earlier in the month across Mariner, Microsoft Edge, and Entra Device Registration.

Actively Exploited Outlook Spoofing Zero-Day

The highlighted flaw of the release is CVE-2026-124194, a Microsoft Outlook spoofing vulnerability that threat actors have actively leveraged in the wild. The bug allows an unauthenticated external attacker to trick a target into opening a specially crafted message file.

When the target opens the malicious file, Outlook initiates an outbound connection to an attacker-controlled network location. Crucially, the application suppresses its standard external-content security warning during this process. This silent connection initiates an automatic Windows authentication handshake, transmitting the victim's NTLMv2 hash over the network to the attacker's server.

Once captured, adversaries can attempt to crack the NTLMv2 hash offline to recover the underlying plaintext password. The compromised credentials can then provide malicious actors with initial unauthorized access to enterprise environments.

Breakdown of Patched Flaws

Approximately 639 of the 1,235 addressed vulnerabilities involve Windows core systems or associated operating system components. As detailed by Infosecurity Magazine, the release is heavily dominated by 536 Elevation of Privilege (EoP) vulnerabilities, alongside 296 Remote Code Execution (RCE) flaws and 157 Information Disclosure bugs.

Among the 66 issues designated as Critical, 48 involve Remote Code Execution, 15 are Elevation of Privilege vulnerabilities, and three represent Use-After-Free defects within Microsoft Edge. Multiple enterprise server and cloud components received critical fixes, including Active Directory Domain Services, Azure OpenAI, and Azure Managed Grafana.

Who Is Affected

The actively exploited Outlook vulnerability affects organizations running Microsoft 365 Apps for Enterprise as well as Office LTSC 2021 and 2024 editions. Because exploitation only requires network connectivity and a single user interaction to open the file, any organization utilizing affected versions of Outlook remains at risk of credential theft.

Beyond Outlook, administrators managing on-premises infrastructure and Azure deployments are widely exposed to the underlying privilege escalation and remote code execution vulnerabilities patched across Active Directory, ASP.NET Core, and Azure developer services.

What You Should Do

Security teams should immediately prioritize testing and deploying updates for Microsoft Outlook and core Office packages to mitigate ongoing active attacks against corporate credentials.

  • Update Outlook immediately: Deploy the latest security updates for Microsoft 365 Apps for Enterprise and Office LTSC suites, beginning with high-privilege administrators and executive personnel.
  • Restrict outbound NTLM traffic: Block outbound SMB connections (TCP port 445) at enterprise network perimeters to prevent systems from leaking authentication hashes to external, attacker-controlled servers.
  • Prioritize Critical RCE fixes: Address critical remote code execution patches impacting Active Directory Domain Services (including CVE-2026-118146) and developer workloads like Azure DevOps and ASP.NET Core.
  • Deploy comprehensive monthly rollups: Schedule enterprise-wide rollouts of the broader Windows system updates across all workstations and servers to resolve the extensive list of privilege escalation vulnerabilities.