November’s 1,093 Microsoft fixes include an Outlook bug hackers use to grab Windows password hashes

Microsoft’s November 2026 Patch Tuesday release patches 1,093 vulnerabilities across 287 products and components, and one of them was already being used in attacks. The exploited flaw, CVE-2026-124194, is a spoofing bug in Outlook that lets a crafted Microsoft Office file hand an attacker the victim’s NTLMv2 password hash. Microsoft shipped the fixes on Nov. 10.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

By severity, the release carries 63 Critical ratings, 1,029 Important, one Moderate and none rated Low. Elevation of privilege accounts for 48.9% of the flaws and remote code execution for 27.1%, so the bulk of the month is about attackers who already have a foothold and want more control, with a smaller slice aimed at running code from outside. Elevation of privilege means a bug that lets someone already running code on a machine gain higher permissions; remote code execution means running code from a distance. The remaining 24% of the flaws covers categories such as spoofing, information disclosure and denial of service.

CVE-2026-124194 and the stolen NTLMv2 hash

Tenable’s breakdown of the release rates CVE-2026-124194 as Moderate, with a CVSSv3 score of 6.5. An attacker would need to convince a target to open a crafted Microsoft Office file; success hands over the target’s valid NTLMv2 hash, which can be used to impersonate that user in follow-on attacks. Microsoft says the flaw was exploited in the wild as a zero-day, and it is the only exploited bug Tenable identifies in the month.

NTLM is a family of Windows authentication protocols that proves an account holder knows a password through a challenge-response exchange. Microsoft’s NTLM overview notes that Kerberos is preferred in Active Directory environments but that NTLM is still supported and required for workgroup members. A captured hash is not the password itself, yet in many setups it is enough to answer a challenge, which is why attackers collect them. The protocol is specified in Microsoft’s NTLM authentication documentation.

Microsoft’s advisory credits a security researcher who used Claude, Anthropic’s AI model, though it does not specify a version. Security researchers have long described captured hashes as a stepping stone: a hash can be relayed to another server that accepts NTLM or, if the underlying password is weak, cracked offline. Tenable’s note about follow-on attacks points to that second stage of an intrusion, not to the Outlook flaw alone.

Word, Excel and SQL Server lead the product counts

The per-product tally in the November 2026 security updates listing is dominated by Office. Microsoft Office Word received 65 fixes and Microsoft Office Excel 64, followed by SQL Server with 53, the Windows Advanced Rasterization Platform with 37, Windows Installer with 36, the Windows Graphics Kernel with 35, the Windows Kernel with 28, Microsoft Office SharePoint with 27 and Windows DNS with 22. Microsoft Office Outlook and Windows Print Spooler components tie at 20 each.

The two Office programs at the top of the list are the ones most likely to open the kind of crafted file the Outlook flaw depends on, though Tenable’s post does not link the counts to that attack. Word and Excel together account for 129 fixes, about 12% of the month’s total, and the top three products, with SQL Server, make up 182 of the 1,093.

Critical-rated flaws in Active Directory, Exchange and Schannel

Beyond the zero-day, the Security Update Guide entries Tenable singles out include CVE-2026-118146 in Active Directory Domain Services, a remote code execution bug scored 8.8 and rated Critical with an “Exploitation More Likely” label; CVE-2026-118207 in Exchange Server, also 8.8 and Critical; and CVE-2026-113862 in Windows NAT, scored 8.1 and Critical. CVE-2026-119952 in Schannel, a remote code execution flaw scored 8.1, carries the same “Exploitation More Likely” assessment. The highest score of the group is CVE-2026-120002 in SharePoint Server, an elevation of privilege bug at 9.9 that Microsoft rates “Exploitation Less Likely.”

Developer tooling is on the list too. Visual Studio Code received CVE-2026-121663, a security feature bypass scored 8.8, and CVE-2026-121662, a remote code execution flaw scored 8.6, both rated Important. Several Important elevation-of-privilege flaws scored 7.8 and marked more likely to be exploited touch the Windows Kernel, Windows Installer, Print Spooler, Windows Management Instrumentation and Winlogon. Tenable’s post gives no exploitation status for those beyond the more-likely labels.

Tenable also lists detection plugins for the release in its plugin search for November 2026, covering the Windows, macOS local security check and Microsoft bulletin families that vulnerability scanners use to find unpatched machines.

Tenable’s write-up names CVE-2026-124194 as the only flaw exploited before patching, and the sources give no detail on who was behind the attacks or how many targets received the booby-trapped files. Tenable’s own text also calls the SharePoint flaw Critical in a heading and Important in the body, a rating discrepancy Microsoft’s guide would settle. The per-CVE pages in that guide carry the acknowledgments and FAQ for each entry, but the guide is built as a JavaScript application, so the Outlook details above rest on Tenable’s reading of the advisory. Administrators comparing the two will want to check the Moderate label and the 6.5 score against Microsoft’s own entry for an exploited flaw.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.