Microsoft’s November 2026 Patch Tuesday fixed 1,094 vulnerabilities, including an Outlook spoofing flaw that attackers are already exploiting to steal Windows login credentials. If your business runs Microsoft 365 or on-premises Exchange, this month’s update needs to go out this week, not whenever IT gets around to it.
- Microsoft patched 1,094 vulnerabilities in November, among the largest monthly releases this year, according to The Register.
- One flaw, CVE-2026-124194, is already being used against real targets. It lets an attacker steal a user’s NTLMv2 password hash through a crafted Outlook message.
- Three other flaws carry the maximum 9.8 severity score and need no password or user click to exploit, including one reachable through Exchange.
- Security researchers flagged roughly 30 of this month’s CVEs as “wormable,” meaning a single infected machine could spread an attack across a network on its own.
- Businesses still running Windows 10 need to confirm their Extended Security Updates are active, since standard Windows 10 patches stopped a year ago.
What is the Outlook zero-day attackers are using right now?
CVE-2026-124194 is a spoofing vulnerability in Outlook. An attacker sends a specially crafted message, and instead of showing the usual warning before connecting to an outside server, Outlook connects automatically and leaks the user’s NTLMv2 hash to a server the attacker controls. With that hash, the attacker can authenticate as the victim on other systems without ever knowing the actual password. The flaw carries a CVSS score of 6.5, which sounds moderate, but active exploitation changes the math: a flaw being used in the wild is more dangerous than a higher-scored flaw sitting unused. The Register and other outlets confirmed active exploitation of CVE-2026-124194 as of the November 10 release.
This is the same family of attack we wrote about when covering business email compromise earlier this year. Stolen credentials, not malware, are still the fastest route into a small business network.
Which other November flaws should IT prioritize?
Three vulnerabilities this month hit the top of the severity scale at 9.8 out of 10, meaning they can be exploited without a password or any action from a user:
- CVE-2026-116928 — an out-of-bounds write in the Windows Search Component, reachable through Exchange.
- CVE-2026-119958 — a flaw in Windows’ LDAP implementation that could let an attacker run code without authentication, with domain controllers at particular risk.
- CVE-2026-112967 — a heap overflow in the Windows Xbox Live Networking Service.
None of these three are confirmed as actively exploited yet, but Zero Day Initiative researcher Dustin Childs counted close to 30 CVEs in this release with “wormable” potential, the kind that let one compromised machine spread an attack to others on the same network with no further help from an attacker. That is the pattern that turned a single infected laptop into a company-wide outage during past ransomware incidents, so these go on the same patching schedule as the Outlook flaw, not a slower one.
How does this affect businesses still on Windows 10?
Standard support for Windows 10 ended in October 2025, so any machine still running it depends entirely on an Extended Security Updates (ESU) subscription to get fixes like the ones in this release. If your business bought into ESU, confirm the licenses are still active and that updates are actually reaching those PCs through your management tools. If you never enrolled, those machines did not get patched this month, or last month, and every new vulnerability Microsoft discloses is a standing risk until the hardware is replaced or ESU coverage is purchased. We covered the ESU pricing and renewal timeline in our Windows 10 ESU year two pricing post if you need the specifics.
What should a Boston small business do this week?
Patch Tuesday fixes do no good sitting in a queue. If your IT provider or internal admin uses a remote monitoring tool, check that this month’s cumulative update has actually installed on every Windows device, server, and laptop, including ones that were off the network on November 10. For Outlook specifically, remind staff that unexpected messages prompting any kind of external connection deserve a second look, even though this particular flaw bypasses the usual warning. If your business handles patch management without outside help, 1,094 fixes in one release is a lot to review on top of a regular workday.
Frequently asked questions
Is CVE-2026-124194 dangerous even if my business doesn’t use the Outlook desktop app?
The flaw is specific to Outlook’s handling of certain message types, so Outlook on the Web and other email clients are not affected the same way. If your staff primarily use a browser-based mail client, your exposure is lower, but confirm with your IT provider which Outlook versions are in use across the company, including on personal devices with company email configured.
Do I need to do anything beyond installing the update?
Installing the November cumulative update addresses the vulnerability itself. Beyond that, it’s worth reviewing whether your network segments NTLM authentication traffic and whether multifactor authentication is enforced on accounts that touch email, since a leaked hash is far less useful to an attacker when MFA blocks the next step.
How quickly should these updates go out?
For the actively exploited Outlook flaw, within days, not weeks. For the other critical flaws, treat them on the same timeline since several are “wormable” and don’t require a user to make a mistake for an attacker to get in.
What if we’re not sure whether our systems are patched?
That uncertainty is itself the problem Patch Tuesday exposes every month. A quick audit of patch status across all endpoints, including ones that work remotely or were off the network recently, is the fastest way to find out.
An Outlook flaw that’s already being exploited to steal login credentials is exactly the kind of risk that gets missed when patching is handled ad hoc or squeezed between other tasks. If you’re not certain every device at your company received November’s updates, or you want a second set of eyes on how your email environment handles NTLM authentication, Boston Managed IT offers a free 15-minute Microsoft 365 and security review. Call (617) 322-5155 or visit bostonmit.com/contact to schedule one.
— Boston Managed IT
