Microsoft released security updates on November 10, 2026, addressing 1,259 software vulnerabilities, led by an actively exploited zero-day spoofing flaw in Microsoft Outlook.
The vulnerability, registered as CVE-2026-124194 with a CVSS score of 6.5, allows remote attackers to capture a user's NTLMv2 authentication hash. An attacker must convince a target to open a specially crafted message file, which prompts Outlook to reach out to an external server without displaying an external content warning. According to Microsoft's advisory, the flaw cannot be triggered through the application's Preview Pane and requires both user interaction and active network connectivity.
Affected Software and Exploitation Mechanics
According to Microsoft, affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The flaw was identified and reported by an independent researcher known as Nono alongside Benoît Sevens of Anthropic, who used the Claude artificial intelligence model to help discover it.
The Cybersecurity and Infrastructure Security Agency added the Outlook vulnerability to its Known Exploited Vulnerabilities catalog. The agency ordered federal civilian executive branch agencies to deploy the update by November 24, 2026.
Who is currently carrying out the attacks in the wild remains unknown, as Microsoft has not attributed the activity to a specific threat group.
November Release Scope and Support Milestones
The November 2026 release resolves 1,094 Microsoft-specific vulnerabilities and republishes 165 CVEs from third parties. Patched flaws cover 726 in Windows, 174 in Office, 59 in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, and 9 in Exchange Server. Satnam Narang of cybersecurity firm Tenable reported that Microsoft has resolved more than 5,000 security flaws throughout 2026.
The release also serves as the final monthly security update for the Enterprise and Education editions of Windows 11 version 23H2. Devices operating on those two editions will no longer receive monthly security patches.
