Microsoft's November 2026 Patch Tuesday addressed 1,259 vulnerabilities, the second consecutive month with more than 1,000 CVEs. One flaw is confirmed exploited in the wild: CVE-2026-124194, an Outlook vulnerability that leaks Windows NTLMv2 authentication hashes to an attacker-controlled server without warning the user. CISA added it to the Known Exploited Vulnerabilities catalog on November 11 with a Federal Civilian Executive Branch remediation deadline of November 24, 2026.
The Outlook NTLMv2 bug
CVE-2026-124194 (CVSS 6.5) was discovered by security researcher Nono and Anthropic's Benoît Sevens, who used Claude in the discovery process. The flaw is exploited through a specially crafted Outlook message file (.msg). When a user opens or previews the file, Outlook silently connects to an attacker-controlled server and sends the user's Windows NTLMv2 authentication hash.
NTLMv2 hashes can be cracked offline or relayed to authenticate against other internal systems without ever needing the plaintext password. The attack requires user interaction (opening or previewing the message) but requires no prior authentication from the attacker. No external content warning appears. The user has no indication that the message triggered an outbound connection.
Other high-severity flaws in this release
Three additional vulnerabilities stand out for severity. Microsoft has not confirmed active exploitation for any of them:
- CVE-2026-116928: Remote code execution in Windows Search. A malicious search result can trigger code execution. Full CVSS score and attack vector details have not yet been published.
- CVE-2026-119958: Remote code execution in LDAP. An unauthenticated attacker capable of sending specially crafted LDAP requests can execute code on domain controllers. Organizations with LDAP exposed to the internet or untrusted segments should treat this as urgent.
- CVE-2026-119990: Privilege escalation in Azure OpenAI. An authenticated attacker can escalate privileges within an Azure OpenAI workspace. Relevant for organizations running production workloads on Azure OpenAI.
What to prioritize
CVE-2026-124194 (Outlook) is confirmed exploited and must be patched now. The November 24 FCEB deadline applies to federal agencies, but confirmed exploitation means private sector organizations should not treat this as a routine patch cycle.
For the broader 1,259-CVE release: apply Microsoft's standard guidance on patch prioritization. Focus first on Critical-rated and internet-facing components, followed by identity infrastructure given CVE-2026-119958's LDAP vector against domain controllers.
The growing volume of monthly patches reflects both more discovery effort and AI-assisted vulnerability research. The discovery of CVE-2026-124194 itself involved an AI tool, which is becoming a pattern across this Patch Tuesday release. Organizations that have not established automated patching for Microsoft products should treat this sustained volume as a signal to do so.