Overview
- The November Patch Tuesday release on Tuesday listed 1,094 CVEs across Windows, Office, Azure and other Microsoft products.
- Microsoft confirmed CVE-2026-124194 as an actively exploited Outlook spoofing flaw that can make Outlook connect to an attacker-controlled location and disclose a user’s NTLMv2 hash when a specially crafted file is opened.
- CISA added the Outlook flaw to its Known Exploited Vulnerabilities catalog, creating a federal remediation deadline and signaling heightened urgency for organizations to apply the patch or mitigations.
- The batch also fixes several high-severity remote code execution bugs, including CVE-2026-116928 in Windows Search reachable through Exchange, which researchers warn can allow zero-click or pre-auth takeover of Exchange servers and domain infrastructure.
- Security teams are under heavy triage pressure after months of record patch volumes in 2026 and are advised to prioritize fixes for externally exposed services, actively exploited flaws, and products that have reached end of servicing.