Microsoft November 2026 Patch Tuesday: Exploited Outlook Flaw Leaks NTLM Hashes, 64 Critical Fixes

Microsoft's November security release, out on 10 November, fixes one flaw that attackers are already using: CVE-2026-124194, an Outlook spoofing bug that hands the victim's NTLMv2 password hash to whoever sent the message. The Security Update Guide lists 1,383 CVE entries for the month: 1,095 issued by Microsoft itself, 165 Chromium fixes carried into Edge and 123 from other issuers. None of them is marked as publicly disclosed before the fix.

The exploited Outlook bug

Microsoft rates CVE-2026-124194 only Moderate, with a CVSS score of 6.5, yet marks it "Exploitation Detected". Its advisory says the flaw "discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user". The same page explains that a crafted message file makes Outlook connect to a location the attacker controls, with no warning about external content, and that the Preview Pane is not an attack vector, so the target has to open the file.

The advisory credits no one with the report and doesn't describe the attacks. CISA's Known Exploited Vulnerabilities catalogue did not list the bug as of 10 November; its latest additions, made on 9 November, included the OpenSSH password bypass on Alpine Linux.

Critical flaws on mail and directory servers

Sixty-four fixes are rated critical. Three of them hit Exchange and domain controllers.

CVE-2026-116928, an out-of-bounds write in Windows Search scored 9.8, can be triggered by an email attachment alone: Microsoft says "Exchange automatically processes the attachment for indexing", so nobody has to open anything. CVE-2026-119958 in Windows LDAP, also 9.8, lets an unauthenticated attacker run code through crafted LDAP calls, which puts domain controllers in scope. Microsoft rates the Search flaw and the LDAP flaw "Exploitation Less Likely".

Exchange Server's own critical bug, CVE-2026-118207 (CVSS 8.8), lets an attacker with a low-privileged login run code on the server by sending a crafted request. Microsoft rates it "Exploitation More Likely".

Updates to install

Outlook comes first, since it is the one under attack: the fixed Office and Outlook builds are listed by product on the CVE-2026-124194 advisory, and the Exchange Server updates on the CVE-2026-118207 advisory. For Windows:

• Windows 11 24H2, 25H2 and 26H2: KB5132061, builds 26100.9974, 26200.9974 and 26300.9974.
• Windows 11 23H2: KB5131087, build 22631.7711.
• Windows 10 21H2 and 22H2: KB5131096, builds 19044.7846 and 19045.7846.

The Windows 11 update may switch on memory integrity (HVCI) on supported PCs, though not where an administrator has already turned it off. The Windows Server packages that domain controllers need are listed in the November release notes.