Microsoft’s November 2026 Patch Tuesday updates repair 1,094 vulnerabilities throughout its merchandise, together with an Outlook bug that the corporate says has been exploited.
The zero-day, tracked as CVE-2026-124194, has been labeled as a spoofing flaw and stems from Outlook not alerting customers earlier than a doubtlessly harmful motion takes place.
Microsoft has assigned it a severity score of ‘reasonable’ and a CVSS rating of 6.5. The corporate’s advisory offers no details about the noticed assaults.
For an assault to work, the sufferer must be tricked into opening a malicious file, in keeping with Microsoft.
“An unauthenticated attacker might ship a specifically crafted message file and persuade a consumer to open it in an affected model of Microsoft Outlook. Opening the file might trigger Outlook to connect with an attacker-controlled community location with out displaying the same old external-content warning, doubtlessly disclosing authentication data that might be used to impersonate the consumer,” the tech big stated.
The flaw can’t be triggered by the Preview Pane, Microsoft stated. It additionally clarified, “This vulnerability discloses a consumer’s NTLMv2 hash to the attacker who might use this to authenticate because the consumer.”
The vulnerability was not publicly disclosed earlier than the repair grew to become obtainable. Affected merchandise embrace Microsoft 365 Apps for Enterprise, Workplace LTSC 2021, and Workplace LTSC 2024.
Microsoft’s advisory credit a researcher utilizing the moniker ‘nono’ and Benoît Sevens with the invention. The acknowledgment for Sevens mentions using Anthropic’s Claude AI mannequin.
Home windows accounts for 726 of the flaws patched this month, adopted by Workplace with 174. Microsoft additionally resolved 59 vulnerabilities in SQL Server, 53 in developer instruments, 27 in SharePoint Server, 20 in Azure, and 9 in Trade Server.
As well as, the corporate republished 165 CVEs from third events, noting that Chrome vulnerabilities are usually not listed.
Microsoft’s launch abstract lists critical-severity updates for Home windows 10, Home windows 11, Home windows Server 2016 by 2025, Workplace, Trade Server Subscription Version, Edge, and the Malware Safety Engine. Azure OpenAI and Azure Managed Grafana are additionally on the listing.
The November launch is smaller than October’s, when Microsoft patched a document 1,413 vulnerabilities. With the newest spherical of patches, Microsoft has fastened greater than 5,000 vulnerabilities this 12 months.
This month’s updates are additionally the last ones for the Enterprise and Training editions of Home windows 11 model 23H2. Gadgets working these editions is not going to obtain any additional month-to-month safety updates.
Adobe’s newest Patch Tuesday updates repair roughly 110 vulnerabilities throughout 9 merchandise.
Associated: Node2Shell: Brotli Flaw Triggers Patching Throughout Microsoft, Node.js, Python Packages
Associated: Microsoft Patches Two Dozen RCE Flaws in Workplace
Associated: Microsoft Patches Report 974 Vulnerabilities, Together with Two Exploited Zero-Days
