Microsoft shipped its November 2026 updates on 10 November. The one to act on first is CVE-2026-124194, an Outlook spoofing flaw that Microsoft says was exploited in the wild. Opening a crafted Office file can expose the user's NTLMv2 hash, which can then be cracked offline or relayed. The Preview Pane is not an attack vector, so the user has to open the file.
Here is a short, practical checklist for sysadmins.
1. Patch through the right channel
- The Outlook fix ships through the Office update channel (Microsoft 365 Apps, Office LTSC 2021/2024). Windows Update alone does not cover it.
- Windows 11 24H2, 25H2 and 26H2 get the cumulative update KB5132061. Send it to a pilot ring before the whole fleet.
2. Prioritise the server side
- Domain controllers: CVE-2026-118146, remote code execution in AD DS (CVSS 8.8)
- Exchange Server: CVE-2026-118207, remote code execution (CVSS 8.8)
- Windows Schannel: CVE-2026-119952, remote code execution (CVSS 8.1)
- SharePoint Server: CVE-2026-120002, elevation of privilege (CVSS 9.9, Exploitation Less Likely)
- Internet-facing systems go first.
3. Shrink the NTLM blast radius
- Block outbound SMB (TCP 445) at the perimeter firewall so hashes cannot leave the network.
- List the legacy apps, file shares and printers that still need NTLM and plan to move them off it.
- Review sign-in logs for unusual NTLM authentication and unknown outbound connections.
- Record which systems were patched and when. Indian teams may need this for CERT-In's 6-hour reporting rule.
More detail: November 2026 Patch Tuesday guide with the full patch order
Written by the team at Affix Center, an IT services company in Lower Parel, Mumbai.
