Microsoft patches 1,093 flaws in November and an Outlook zero-day that steals NTLM hashes

November 10, 2026. Microsoft publishes its November Patch Tuesday: 1,093 flaws fixed, 63 of them critical. November 10, 2026. A single actively exploited zero-day: CVE-2026-124194, an Outlook spoofing flaw that leaks the user’s NTLMv2 hash. November 10, 2026. The volume drops about 22 % from October’s record of 1,411 flaws — and remains enormous. Why it matters: the most dangerous flaw of the month is not the highest-scoring one — it is rated Moderate, at CVSS 6.5.

The Outlook zero-day, and what it says about triage

CVE-2026-124194 is a spoofing flaw in Outlook, rated CVSS 6.5 — Moderate, a long way from the 9.8s that make headlines. Its weakness (CWE-356) is a missing warning about unsafe actions: without that guardrail, an unauthenticated attacker sends a crafted message file; the moment the victim opens it in Outlook, the client connects to an attacker-controlled location without showing the usual external-content warning, and discloses the NTLMv2 hash.

That hash is not the password, but it is the next best thing: it can be relayed to a legitimate server to impersonate the victim, or cracked offline where password policy is weak. It is an old, still-profitable attack primitive. The Preview Pane is not a vector — opening the file is required — which narrows exposure to users who click, but does not remove it: a crafted .msg attachment is exactly what phishing knows how to get opened.

Affected products are Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise, in both 32- and 64-bit editions. Microsoft confirms attacks, without revealing scale or victims. Two other Outlook code-execution flaws, CVE-2026-124227 and CVE-2026-124228, are rated Important and are not marked exploited.

November’s volume, in numbers

The release breaks down as 535 elevation-of-privilege, 296 remote-code-execution, 156 information-disclosure, 46 denial-of-service, 27 security-feature-bypass, 22 spoofing, and 11 tampering flaws. The 63 critical flaws split even more tellingly: 48 are RCE, 15 are privilege escalations.

Compared with the prior month, the dip is real but relative. October 2026 set a record of 1,411 flaws; November ships 1,093. Nobody should read that as a return to normal: before the era of AI-assisted patching, a “heavy” Patch Tuesday topped out around 120 to 150 flaws. The flow remains an order of magnitude above what teams sized for a monthly cadence can absorb.

The criticals that face outward

Under the total, the map of critical flaws draws the surface to patch first. Excel alone carries 12 critical flaws, Word four, and PowerPoint one — the Office suite stays the entry path users hand attackers. Outlook receives three critical RCEs, none exploited: CVE-2026-111309, CVE-2026-110068, and CVE-2026-110043.

On the infrastructure side, services that listen on the network concentrate the danger. Hyper-V carries eight critical privilege escalations — critical for any cloud or VM host. Message Queuing (MSMQ) carries five critical RCEs across its core and Queue Manager. The release also fixes critical flaws in the SMB transport (CVE-2026-113825), TCP/IP (CVE-2026-113859), Exchange Server (CVE-2026-118207), and LDAP (CVE-2026-119958), plus Schannel, CredSSP, IIS, the Print Spooler, Active Directory Domain Services, and the RPC runtime.

Cloud services are not spared: Azure OpenAI (CVE-2026-119990) and Azure Managed Grafana (CVE-2026-114160) each receive a critical privilege escalation, and Microsoft Defender a critical RCE (CVE-2026-122194) — a reminder that the defense tool itself has an attack surface.

What a “Moderate” zero-day teaches a CISO

The month’s most instructive fact is the gap between displayed severity and real severity. The only exploited flaw in the batch is rated Moderate at CVSS 6.5. The most spectacular flaws on paper — the 9.8 RCEs — are, as of writing, not exploited.

That is not a scoring accident: it is the structural limit of CVSS, which measures the worst theoretical consequence, not the likelihood of exploitation. An NTLMv2 hash leak has a “moderate” consequence on its own — you still have to relay or crack it — but it is already being exploited, while a network “critical” RCE may still be waiting for an author. The signal that should drive triage is therefore “exploited in the wild,” not the score.

The second lesson is about the target. NTLM hash theft is a return to fundamentals: it aims at identity, not code execution. In a world where authentication has become the real perimeter — Entra ID, SSO, passkeys — a flaw that compromises an authentication hash is often worth more than one that compromises a local process. It is the same logic as the AD DS and Exchange flaws of prior months: what touches identity or mail is paid for in domain control, not a mere crash.

From a stolen hash to domain control: the full chain

An NTLMv2 hash leak is only the first link. The full chain is well known to defenders: relay the hash to an SMB or HTTP service that accepts the authentication, or crack it offline where password policy is weak. Every link has a countermeasure — mandatory SMB signing, Extended Protection for Authentication (EPA), disabling NTLM in favor of Kerberos, and protected accounts for high privilege — but those countermeasures deploy at the estate level, not per machine.

The lesson for a CISO is twofold. First, this month’s zero-day does not need a 9.8 to be dangerous: a 6.5 that steals an authentication hash, exploited today, is worth a fix tonight. Second, the NTLM surface is a legacy: every service that still accepts it is a target the Outlook patch will not close. Fixing the flaw is necessary; shrinking NTLM is the project that makes the next flaw harmless.

It is the same asymmetry the AI-assisted patch era keeps producing: volumes that were once records are now routine, so the scarce resource is no longer finding the patch but deciding what to patch first. A triage that starts from exploitation status and exposure, rather than raw CVSS, is what turns a 1,093-item list from a wall into a sorted queue.

The patch itself is routine to deploy — a standard cumulative update for the affected Office editions. What is not routine is the discipline it demands: because the flaw sits in the mail client rather than a server, it spreads the risk across every desk, and the only durable fix is a combination of the update and the NTLM hardening above.

Verdict

If you run Outlook in the enterprise, deploy the CVE-2026-124194 fix tonight on Office LTSC 2021/2024 and Microsoft 365 Apps for Enterprise — it is the only actively exploited flaw in the batch, and it needs only a click on a crafted file to steal an authentication hash. If you host VMs or cloud workloads, put the eight Hyper-V privilege escalations and five MSMQ RCEs in the same window, alongside SMB, TCP/IP, Exchange, and LDAP: these are the criticals that face outward. And if you still triage by CVSS alone, change the reflex now — the score does not predict exploitation; rank by exploitation status first, by network exposure second, and leave the theoretical 9.8 where it belongs: one signal among several, not an order of priority.

References

• Cyber Security News — Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities Including Outlook Zero-Day, November 10, 2026
• Tenable — November 2026 Microsoft Patch Tuesday, November 10, 2026
• Microsoft Security Response Center — CVE-2026-124194
• BleepingComputer — Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days, October 13, 2026