Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes Ravie LakshmananNov 11, 2026Vulnerability / Windows Security Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers. More than 500 flaws relate to elevation of privilege, followed by remote code execution and information disclosure bugs. With the latest round of fixes, Microsoft has addressed over 5,100 CVEs this year alone, according to Satnam Narang, senior staff research engineer at Tenable. Of these, a Moderate-severity security flaw in Microsoft Outlook (CVE-2026-124194, CVSS score: 6.5) has been flagged as actively exploited by Microsoft. "Product UI does not warn users of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network," Microsoft said in an advisory. An unauthenticated attacker could send a specially crafted message file and persuade a target to open it in an affected version of Microsoft Outlook. This, in turn, could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information, such as an NTLMv2 hash, that could be used to impersonate the user. Microsoft emphasized that successful exploitation requires network connectivity and user interaction. The tech giant credited a researcher named Nono and Anthropic's Benoît Sevens (using Claude) with discovering and reporting the flaw. "Email is the easiest door into any company, and this flaw turns one opened file into a stolen identity," Jack Bicer, director of vulnerability research at Action1, said. "A captured hash can let an attacker sign in as the victim, read their data, and move to other systems they can reach." "The Moderate label undersells this one. Attackers are already exploiting it, it needs only one click on an email file, and it hits Outlook, which nearly every organization runs. A stolen hash can open doors far beyond the inbox." That said, Redmond has not attributed the activity to a particular threat actor or provided technical details on how the vulnerability is being exploited in the wild. The advisory also doesn't spell out whether the discovery came before or after attackers began exploiting the flaw. The development has prompted the U.S. U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the flaw to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fix by November 24, 2026. Some other vulnerabilities of note include a number of remote code execution flaws impacting Windows Search (CVE-2026-116928), Lightweight Directory Access Protocol (CVE-2026-119958), Windows Schannel (CVE-2026-119952), Windows Virtual Filtering Platform (CVE-2026-95962), and Windows Xbox Live Networking Service (CVE-2026-112967), as well as a privilege escalation flaw in Azure OpenAI (CVE-2026-119990). "Most security teams haven't quite recovered from the last month of bumper-to-bumper critical vulnerabilities, emergency patches, and '2shell'-branded everything, and we're yet again at another Patch Tuesday," Jake Knott, head of threat intelligence at watchTowr, said. "Teams are really starting to feel the strain of working out 'what actually matters?' when there is fire after fire every day demanding immediate attention. Start with what you actually have exposed to the Internet, then what’s already being exploited in the wild, and only then everything else. Before going into panic mode, check whether you even use the vulnerable component, or meet the prerequisites for exploitation." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, Cyber Attack, email security, Microsoft, Vulnerability, Windows Security The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads The Flood is Coming And The Pipes Were Already Full Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register for Free Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. ROI Calculator: See the Value of IAM Automation Calculate your savings on audits, app onboarding, and discovery. Try it now. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk