Title: Microsoft November 2026 Patch Tuesday: Exploited Outlook Flaw CVE-2026-124194 Added to CISA’s KEV Catalog
Summary: Microsoft shipped its November Patch Tuesday on November 10, 2026, fixing a total of 1,259 vulnerabilities — the second consecutive month above 1,000 fixes (October was 1,413). Per The Hacker News, the round covers 726 flaws in Windows, 174 in Office, 59 in SQL Server and 27 in SharePoint Server, plus 165 non-Microsoft-issued CVEs; more than 500 of the fixes are elevation-of-privilege bugs, followed by remote code execution and information disclosure. Tenable’s Satnam Narang counts over 5,100 CVEs Microsoft has addressed this year alone. The one flaw Microsoft flags as actively exploited is CVE-2026-124194, a Moderate-severity (CVSS 6.5) Outlook issue: a message file the attacker prepared is enough to make a victim’s client reach out to a server under the attacker’s control instead of showing the normal warning about external content, and any authentication material the connection leaks — an NTLMv2 hash among it — can then be replayed to pose as that user. Microsoft notes successful exploitation requires network connectivity and user interaction, credits researcher Nono and Anthropic’s Benoît Sevens (using Claude) with the report, and does not attribute the exploitation to any actor. CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10 (part of a six-entry batch that also includes two Barracuda flaws), giving US federal civilian agencies until November 24, 2026 to patch under Binding Operational Directive 26-04. Other notable fixes include RCEs in Windows Search (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), Windows Virtual Filtering Platform (CVE-2026-95962) and Xbox Live Networking Service (CVE-2026-112967), plus a privilege-escalation flaw in Azure OpenAI (CVE-2026-119990). Windows-heavy estates — including those running Linux servers that authenticate against Active Directory — should prioritize the Outlook fix and treat captured-NTLM risk accordingly.
References: