Microsoft’s November security release fixes 1,094 vulnerabilities, including an Outlook spoofing flaw the company says is being exploited to obtain users’ NTLM authentication hashes. The release also addresses 63 critical vulnerabilities, according to Microsoft’s November 2026 Security Update Guide.
The actively exploited issue, CVE-2026-124194, carries a CVSS 3.1 score of 6.5 and affects Microsoft Outlook. Microsoft describes a scenario in which an unauthenticated attacker sends a specially crafted message file and persuades a target to open it. Outlook may then connect to an attacker-controlled network location without showing its normal external-content warning, disclosing the user’s NTLMv2 hash. That material can potentially support credential relay, impersonation or offline password cracking.
Microsoft has not publicly attributed the attacks to a specific threat actor, and the company has not identified a public proof of concept in the advisory data. The exploitation warning nevertheless makes this a priority for organizations using Microsoft 365 Apps for Enterprise or Office LTSC 2021 and 2024. Because the fix is delivered through Office, applying Windows cumulative updates alone may leave vulnerable Outlook installations exposed.
Administrators should also review CVE-2026-116928, a Windows Search out-of-bounds write vulnerability rated critical with a CVSS score of 9.8. Microsoft says an unauthorized attacker could execute code over a network; its assessment does not indicate that the flaw is currently exploited. The issue is particularly concerning in environments where Exchange content is automatically indexed, although Microsoft has not said that opening an attachment is unnecessary in every affected configuration or reported active exploitation.
Microsoft released the November fixes on Nov. 10. Windows 11 customers should install the applicable cumulative update, including KB5132061 for supported Windows 11 24H2, 25H2 and 26H2 systems, then verify the result under Settings and Windows Update. Office users can open an Office application, choose File, Account, Update Options and Update Now; on managed devices, patch deployment may be controlled by the organization’s IT team.
