Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability.
This Patch Tuesday addresses 66 "Critical" vulnerabilities, 48 of which are Remote Code Execution (RCE), 15 are Elevation of Privilege (EoP), and three are Use-After-Free in Microsoft Edge.
Entenda a falha
A vulnerabilidade
The most severe item is CVE-2026-124194, a Microsoft Outlook spoofing flaw (CVSS 6.5, rated moderate) that Microsoft says was exploited as a zero-day. An unauthenticated attacker sends a crafted message file and the user must open it; the Preview Pane is not a vector. The attacker obtains the user's NTLMv2 hash and can authenticate as that user. Affected are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024, fixed in the November 2026 updates. The release has over 1,000 other CVEs (the count varies by outlet). Standouts: CVE-2026-116928 (Windows Search via Exchange, CVSS 9.8, zero-click RCE), CVE-2026-119958 (LDAP RCE), CVE-2026-119952 (Schannel RCE), CVE-2026-95962 (VFP RCE), CVE-2026-112967 (Xbox Live Networking RCE), CVE-2026-118146 (AD DS RCE), CVE-2026-118207 (Exchange RCE) and CVE-2026-120002 (SharePoint EoP, CVSS 9.9).
Como funciona
For CVE-2026-124194, the victim receives a crafted message file and opens it in an affected Outlook. Outlook then connects to a network location controlled by the attacker, and does so without showing the usual external-content warning. During that connection Windows may automatically try to authenticate to the remote server, which exposes the user's NTLMv2 hash. The attacker captures it and can use it to impersonate the user, or crack it offline. For CVE-2026-116928, the articles say an email attachment triggers the bug when the server automatically indexes it, so the recipient never opens anything.
Por que é vulnerável
For CVE-2026-124194, Outlook fails to alert the user before a potentially dangerous action, the outbound connection to an external location, so the external-content warning is skipped and credential material leaks. The patch addresses this behavior, though the articles do not detail the code change. Other causes cited: incorrect authorization (CVE-2026-118146, CVE-2026-120002), an observable timing discrepancy (CVE-2026-119952), an out-of-bounds write (CVE-2026-119958), a use-after-free with a race condition (CVE-2026-95962) and a heap overflow (CVE-2026-112967).
Como foi descoberta
Microsoft says CVE-2026-124194 was exploited in the wild, but its advisory gives no details about the attacks. It was not publicly disclosed before the fix. The advisory credits a researcher using the handle 'nono' and Benoît Sevens; the acknowledgment for Sevens mentions the use of Anthropic's Claude, and Tenable says no specific Claude version is named. The articles do not describe how or when it was reported. It reached the public through Microsoft's November 2026 Patch Tuesday.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No article mentions a public proof of concept. Microsoft says CVE-2026-124194 was exploited in real attacks, so a working exploit exists in attackers' hands, but no published copy or details of the attacks are given. Because it is exploited, patching it should be the first priority, even with a modest CVSS of 6.5.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 17:15.
Linha do tempo
-
Zero Day Initiative — The November 2026 Security Update Review
ler a análise desta fonte ocultar
The penultimate month of 2026 bring with it the usual storm of patches from Microsoft and Adobe. I’ve been prototyping some new ways to display this data, but as always, I’m open to suggestions. Seriously – hit me up on Bluesky if you have any ideas. If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release.
For the first part of the November release, Adobe released nine bulletins addressing 110 unique CVEs in Adobe Connect, Experience Manager, After Effects, Audition, Dimension, Photoshop, Media Encoder, Premiere, and Content Credentials SDK.
-
November 2026 Microsoft Patch Tuesday | Tenable®
ler a análise desta fonte ocultar
63Critical 1029Important 1Moderate 0Low Microsoft addresses 1093 CVEs in the eleventh Patch Tuesday of 2026. Microsoft patched 1093 CVEs in its November 2026 Patch Tuesday release, with 63 rated critical, 1029 rated as important, and one rated as moderate. This month’s update includes patches for 287 products and components. The following table lists the products with the most CVEs patched this month. A full list of patched products is available in the appendix. RankProductCVE Count1Microsoft Office Word652Microsoft Office Excel643SQL Server534Windows Advanced Rasterization Platform375Windows Installer366Windows Graphics Kernel357Windows Kernel288Microsoft Office SharePoint279Windows DNS2210 (Tie)Microsoft Office Outlook2010 (Tie)Windows Print Spooler Components20Elevation of Privilege (EoP) vulnerabilities accounted for 48.9% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 27.1%. ModerateCVE-2026-124194 | Microsoft Outlook spoofing vulnerability CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook. It received a CVSSv3 score of 6.5 and is rated moderate. An attacker could exploit this vulnerability by convincing a target to open a crafted Microsoft Office file. Successful exploitation would allow an attacker to obtain the target’s valid NTLMv2 hash, which can then be used to impersonate that user in follow-on at...
-
Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
ler a análise desta fonte ocultar
Microsoft’s November 2026 Patch Tuesday updates fix 1,094 vulnerabilities across its products, including an Outlook bug that the company says has been exploited.
The zero-day, tracked as CVE-2026-124194, has been classified as a spoofing flaw and stems from Outlook not alerting users before a potentially dangerous action takes place.
-
Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
ler a análise desta fonte ocultar
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability.
This Patch Tuesday addresses 66 "Critical" vulnerabilities, 48 of which are Remote Code Execution (RCE), 15 are Elevation of Privilege (EoP), and three are Use-After-Free in Microsoft Edge.