The Outlook zero-day

Microsoft shipped its November security updates on Tuesday, November 10, 2026, and only one flaw in the batch was already being used in attacks. It is not the scariest-looking one. CVE-2026-124194 is a spoofing bug in classic Outlook, rated Moderate with a CVSS score of 6.5.

Here is how it works. The victim opens a crafted message file, and Outlook connects to a network location the attacker controls without showing its usual external-content warning. That connection gives away the victim's NTLMv2 hash. According to BleepingComputer, attackers have been doing exactly that: collecting NTLM hashes, cracking them offline and using them to get into corporate accounts.

Two limits keep it from being worse. The victim has to open the file. CrowdStrike's analysis says the Preview Pane is not an attack vector, so this is not a zero-click bug. The victim's machine also has to be able to reach the attacker's server. The fix covers every supported version of classic Outlook. Microsoft has not said who found the flaw, and Rapid7 says none of this month's flaws was publicly disclosed before the patch. The official entry is on Microsoft's Security Update Guide.

Why a 6.5 goes to the top of the list

A stolen NTLMv2 hash is a password waiting to be cracked. Weak passwords fall quickly offline, and the cracking never shows up in your logs. The CVSS score rates the bug in Outlook. It does not rate what an attacker does with the account afterwards, which is why the one flaw in active use this month outranks dozens of Critical ones nobody has been seen exploiting.

The Windows 11 update also hardens NTLM in general. KB5132061 makes clients offer NTLM message signing by default on non-anonymous connections, and logs connections that do not sign. Two broader mitigations help against this whole class of hash leak. They are standard advice, not something Microsoft tied to this CVE: block outbound SMB (TCP 445) to the internet at the firewall, and put high-value accounts in the Protected Users group, which stops them from authenticating with NTLM at all.

How many flaws, depending on who counts

The size of the release depends on who is counting, so each figure here names its source. BleepingComputer counts 1,235 flaws, 142 of them in the Chromium-based Microsoft Edge. Take Edge out and roughly 1,093 are in Microsoft's own products. Rapid7 says 1,092. CrowdStrike counts its own way and gets 1,252.

The Critical count disagrees too. BleepingComputer says 66 (48 remote code execution, 15 elevation of privilege, 3 use-after-free bugs in Edge). CrowdStrike says 68. BleepingComputer calls the release a record, but the same report puts October at 1,411, so November is one of the largest rather than the largest. Rapid7 makes a sharper point: patch volume keeps climbing, but the number of exploited bugs has not climbed with it. This month there is exactly one.

The server bugs to patch next

None of these is known to be exploited. None needs anyone to click.

Windows Schannel, CVE-2026-119952. Schannel is Windows' own TLS implementation, and this is a pre-authentication remote code execution bug triggered by crafted packets. It needs specific conditions to work, but Microsoft still rates exploitation "more likely", and because anything that speaks TLS is a candidate, vulnerable machines may be easy to find. Our sources give no CVSS score for it.

Windows Search, CVE-2026-116928 (CVSS 9.8). An out-of-bounds write reached by email. Send an attachment to an Exchange server and it gets indexed automatically, with no user involved. Rapid7 expects the code runs as SYSTEM.

Windows LDAP, CVE-2026-119958 (CVSS 9.8). Another out-of-bounds write, this one reachable through unauthenticated, crafted LDAP calls. Domain controllers are the machines answering LDAP, so they belong near the front of the queue.

Behind those three, CrowdStrike lists:

• Active Directory Domain Services: remote code execution CVE-2026-118146 (8.8, needs an authenticated low-privilege attacker) and elevation to SYSTEM CVE-2026-118148 (7.5, requires winning a race condition).
• Exchange Server remote code execution CVE-2026-118207 (8.8, authenticated, no user interaction).
• Eight Hyper-V privilege-escalation fixes, the worst CVE-2026-113753 (8.2, reaches VTL1).
• Remote Desktop Services CVE-2026-119957 (7.8, a guest-to-host escape).
• SMB server (srvnet.sys) CVE-2026-113825 and Print Spooler CVE-2026-113752 (both 7.5, the spooler bug from the adjacent network).

Preview Pane bugs, third month running

For the third month in a row, the biggest group of Critical Office bugs can fire from the Preview Pane, so the file never has to be opened. CrowdStrike lists eight Critical remote code execution flaws: CVE-2026-110043, CVE-2026-110068 and CVE-2026-111309 in Outlook; CVE-2026-110067, CVE-2026-111285 and CVE-2026-124185 in Word; and CVE-2026-111289 and CVE-2026-120003 in Office. All score 8.8 except CVE-2026-124185, at 7.5.

They are the mirror image of the zero-day: worse on paper, asking less of the victim, and not seen in attacks. The Office updates that fix the Outlook zero-day also fix these, so a single Office rollout covers both.

The two highest scores of the month need nothing from you. CVE-2026-109469 in Entra Device Registration (10.0) and CVE-2026-119990 in Azure OpenAI (9.8) are cloud-side flaws that Microsoft has already fixed on its own servers. There is nothing to install.

The Windows updates and what else changes

Windows 11 gets KB5132061 and KB5131087. Windows 10 now only gets fixes through Extended Security Updates, this month as KB5131096. KB5132061 moves Windows 11 26H2 and 25H2 (all editions) and 24H2 Enterprise and Education to builds 26300.9974, 26200.9974 and 26100.9974. Microsoft listed no known issues for it when we checked on November 12, 2026.

One change can break scripts you already run. Signed PowerShell scripts now get stricter UTF-8 validation, and a script containing invalid UTF-8 may fail its signature check. The fix is to save it again with a BOM and re-sign it, so test signed automation before a wide rollout. The update also repairs two problems the October updates caused: adding printers published in Active Directory failed with error 87, and RDP connections failed on a certificate mismatch after the October preview.

Several products also reached end of support on November 11: .NET 8 LTS, PowerShell 7.4 LTS, and the Enterprise, Education and IoT editions of Windows 11 23H2. Rapid7 adds that every Exchange Server version except Subscription Edition is now past end of support, which matters in a month with Exchange and Windows Search bugs.

What to patch, in order

Classic Outlook goes first, everywhere, because that is the bug being used. Next are Windows servers exposed to the network: anything terminating TLS through Schannel, Exchange servers and domain controllers. Then the Office update for the Preview Pane bugs, then everything else. If you build on .NET 8 or PowerShell 7.4, plan the move to a supported version now. December's fixes will not reach them.

The rest of the week was busy too, according to BleepingComputer. Ivanti fixed two Connect Secure flaws that had been chained in attacks since October 1. SonicWall patched an exploited SSL-VPN MFA bypass. Zyxel fixed a GS1900 switch zero-day used to compromise nearly 1,000 devices and Google shipped an emergency Chrome fix for its eighth zero-day this year. Our October Patch Tuesday coverage covers last month's Windows Shell zero-day. The next Patch Tuesday is December 8.