TL;DR

  • what: Microsoft's November 2026 Patch Tuesday fixed 1,259 vulnerabilities, including CVE-2026-124194, an actively exploited Outlook flaw that suppresses the external-content warning.
  • impact: One opened message file can make Outlook connect to an attacker-controlled server and hand over the user's NTLMv2 hash, which attackers can use to impersonate that user across the network.
  • fix: Microsoft's November 2026 security update fixes CVE-2026-124194, and CISA has added it to the KEV catalog with a November 24, 2026 deadline for federal agencies.
  • who: Any organization running affected Microsoft Outlook versions, which covers nearly every Microsoft 365 and Exchange shop, plus teams exposed to the Windows Search, LDAP, Schannel and Azure OpenAI flaws in the same release.

Microsoft shipped fixes for 1,259 vulnerabilities on November 10, 2026, the second consecutive month that Patch Tuesday has crossed 1,000 CVEs. Buried in that volume is the one that matters most this week: CVE-2026-124194, a Microsoft Outlook flaw that Microsoft confirms is being exploited in the wild. A single opened message file can cause Outlook to reach out to an attacker's server without the usual warning and leak the user's NTLMv2 hash. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal remediation deadline of November 24, 2026.

The Exploited Outlook Flaw: CVE-2026-124194

Microsoft rates CVE-2026-124194 as Moderate with a CVSS score of 6.5 and classifies it as spoofing. Its advisory describes the root cause as a product UI that "does not warn users of unsafe actions." In practice, an unauthenticated attacker sends a specially crafted message file and persuades the target to open it in an affected Outlook build. Outlook then connects to an attacker-controlled network location and skips the external-content warning that would normally stop or flag that connection.

That outbound connection carries authentication material. Microsoft states it can disclose information such as the user's NTLMv2 hash, which an attacker can use to impersonate the user. Exploitation requires network connectivity and one user action: opening the file. Microsoft credited a researcher named Nono and Anthropic's Benoît Sevens, who used Claude, with discovering and reporting the issue.

⚠️ Severity label vs. real risk — CVE-2026-124194 carries a Moderate rating and a 6.5 CVSS score, but it is confirmed exploited, needs no authentication, requires only one opened file, and targets Outlook, which nearly every enterprise runs. Treat it as a priority item regardless of the label.

Why a Leaked NTLMv2 Hash Is a Big Deal

Forced NTLM authentication is a well-worn technique because the payoff is an identity, not just a mailbox. Jack Bicer, director of vulnerability research at Action1, summarized it: "Email is the easiest door into any company, and this flaw turns one opened file into a stolen identity." A captured hash gives an attacker several options:

  • Offline cracking of the NTLMv2 response to recover weak or reused passwords.
  • Relay of the authentication to other internal services that still accept NTLM, letting the attacker act as the victim without ever knowing the password.
  • Access to the victim's data and lateral movement to any system the victim's account can reach.
  • A foothold that bypasses perimeter controls, since the initial lure arrives through normal email delivery.

Bicer added that "the Moderate label undersells this one," pointing to the combination of active exploitation, one-click delivery and near-universal deployment. The blast radius scales with the privileges of whoever opens the file. A help desk technician or IT administrator falling for the lure is a very different incident than a single sales mailbox.

What Microsoft Has Not Disclosed

Microsoft has not attributed the in-the-wild activity to any threat actor and has published no technical details on how attackers are delivering or weaponizing the flaw. The advisory also does not say whether the researchers found the bug before or after exploitation began. That leaves defenders without vendor-supplied indicators of compromise, lure samples or infrastructure to hunt for. Detection today depends on generic signals of outbound NTLM authentication to external hosts rather than a known campaign signature.

The Rest of the 1,259

The release breaks down to 726 flaws in Windows, 174 in Office, 59 in SQL Server, 27 in SharePoint Server and dozens in Developer Tools, plus 165 CVE identifiers issued by third parties. More than 500 are elevation of privilege bugs, followed by remote code execution and information disclosure. According to Satnam Narang of Tenable, Microsoft has now addressed more than 5,100 CVEs in 2026. Notable non-exploited flaws include:

  • CVE-2026-116928: remote code execution in Windows Search.
  • CVE-2026-119958: remote code execution in Lightweight Directory Access Protocol (LDAP), relevant to every domain controller.
  • CVE-2026-119952: remote code execution in Windows Schannel, the TLS stack used across Windows services.
  • CVE-2026-95962: remote code execution in the Windows Virtual Filtering Platform.
  • CVE-2026-112967: remote code execution in the Windows Xbox Live Networking Service.
  • CVE-2026-119990: elevation of privilege in Azure OpenAI.

The LDAP and Schannel bugs deserve attention because they sit in core infrastructure that is often reachable from wide parts of the network. Microsoft has not reported exploitation for any of them.

Patch Fatigue Is Now an Operational Risk

Two consecutive months above 1,000 CVEs is a structural shift, not a spike. Jake Knott, head of threat intelligence at watchTowr, noted that most teams "haven't quite recovered from the last month of bumper-to-bumper critical vulnerabilities" and are struggling to work out what actually matters. His recommended order is internet-exposed assets first, then flaws already exploited in the wild, then everything else, after confirming whether the vulnerable component is even present and whether exploitation prerequisites are met.

Where CVE-2026-124194 lands in that order — It is confirmed exploited, it is delivered through email that reaches every user, and Outlook is present on nearly every endpoint. By any prioritization model, it belongs at the top of this month's queue alongside internet-facing systems.

The volume problem also cuts against defenders in a quieter way. When a release contains 1,259 entries, a 6.5 Moderate rating is easy to filter out of a dashboard sorted by CVSS. Attackers do not sort by CVSS. They pick the flaw that gets them credentials with the least friction, and this month that is an Outlook bug most scoring systems will rank below hundreds of others.

RedEye Assessment

CVE-2026-124194 is the priority item from this release. It turns routine email into a credential theft channel, and the stolen NTLMv2 hash can carry an attacker well past the inbox into file shares, internal applications and administrative systems. Microsoft's November 2026 update is the fix, and the CISA KEV listing confirms the federal government considers it an active threat. Organizations should also expect the LDAP and Schannel remote code execution flaws to draw researcher and attacker interest in the coming weeks. RedEye Security can assess your Outlook and NTLM exposure, validate patch coverage across this release, and identify where a single stolen hash would lead in your environment. Contact RedEye for an assessment.

Originally published on RedEye Threat Intelligence.