Microsoft November Patch Tuesday fixes about 1,090 flaws, one exploited Outlook bug

Microsoft's November Patch Tuesday security updates address about 1,090 new vulnerabilities, fewer than the roughly 1,400 in the previous month, according to Security Affairs. Only one bug is under active attack, CVE-2026-124194, an Outlook spoofing flaw with a CVSS score of 6.5. An attacker sends a crafted message file and persuades the user to open it, after which Outlook connects to an attacker-controlled location without the usual external-content warning, potentially leaking the user's NTLMv2 hash. The Preview Pane is not an attack path, and Microsoft marks the bug as exploited.

Security Affairs, citing ZDI, highlights several other patches. CVE-2026-116928 is a zero-click Windows Search remote code execution bug reached through Exchange Server, with a CVSS score of 9.8. CVE-2026-119958 is an out-of-bounds write in the Windows LDAP service that could be destructive on domain controllers. CVE-2026-119952, a Schannel remote code execution flaw, is marked "Exploitation More Likely". CVE-2026-119990, an Azure OpenAI elevation of privilege bug, was revised by Microsoft to say no customer action is needed.

ZDI counts 30 potentially wormable bugs this month, down from 59 last month, and warns that it may be wrong on some because a few advisories are light on detail. ZDI recommends testing and deploying the patches quickly, especially for network-facing services such as DNS, DHCP, LDAP and Exchange.

Why it matters Security teams should prioritize CVE-2026-124194 because Microsoft marks it as exploited, even though its CVSS score is 6.5 and it requires user interaction. For network-facing services such as DNS, DHCP, LDAP and Exchange, the 30 potentially wormable bugs and the zero-click Exchange Server issue make patch order and testing a matter of early attention. Investigators should note that the Outlook flaw can expose NTLMv2 hashes, which can be used to impersonate a user.