作者：Shar Z，Nine-Security 資安工程師

微軟 11 月 10 日（美國時間）發布 2026 年 11 月 Patch Tuesday，又是一次超大規模更新：Tenable 統計 1,093 個 CVE、SecurityWeek 為 1,094 個、BleepingComputer 則報導 1,235 個，數字依各家計算範圍而不同。其中唯一確認遭實際利用的，是防守方最該優先處理的 CVE-2026-124194——一個會讓攻擊者取得受害者 NTLMv2 雜湊的 Microsoft Outlook 偽冒（Spoofing）漏洞。

發生了什麼事

根據 SecurityWeek 與 BleepingComputer 引述的微軟公告：未經驗證的攻擊者可寄送特製的郵件檔案，誘使使用者在受影響版本的 Outlook 中開啟；開啟後 Outlook 會在不顯示一般外部內容警告的情況下，連線到攻擊者控制的網路位置。

這個對外連線會帶上使用者的 NTLMv2 驗證資訊。攻擊者截取後，可離線破解或進行中繼（relay）來冒用該使用者身分。

重點整理：

  • 嚴重性： 微軟評為「中度」（Moderate），CVSS 6.5。但別被分數誤導——它已確認遭利用，而竊取 NTLM 雜湊常是帳號接管與橫向移動的第一步。
  • 需要使用者互動： 受害者必須開啟檔案；微軟表示無法透過預覽窗格觸發。
  • 受影響產品： Microsoft 365 Apps for Enterprise、Office LTSC 2021、Office LTSC 2024（依 SecurityWeek）。
  • 修補前未公開揭露，微軟也未說明觀察到的攻擊細節。
  • 發現者： 化名「nono」的研究人員與 Benoît Sevens；微軟致謝中註明 Sevens 使用了 Anthropic 的 Claude。

本月其他值得優先處理的漏洞

依 Tenable 分析：

  • CVE-2026-118146：Active Directory 網域服務 RCE（CVSS 8.8，重大，「較可能被利用」），需驗證。
  • CVE-2026-118207：Exchange Server RCE（CVSS 8.8，重大，「較可能被利用」），需驗證。
  • CVE-2026-119952：Windows Schannel RCE（CVSS 8.1，重大），無需驗證，「較可能被利用」。
  • CVE-2026-120002：SharePoint Server 權限提升（CVSS 9.9，重要）。
  • CVE-2026-113862：Windows NAT RCE（CVSS 8.1，重大）。

另外 SecurityWeek 指出，這是 Windows 11 23H2 企業版與教育版的最後一次安全更新，之後不再有每月修補。

現在該做什麼

1. 先修 Outlook／Microsoft 365 Apps。 推送 11 月 Office 更新，並確認隨選即用（Click-to-Run）用戶端確實已更新到 MSRC 公告中 CVE-2026-124194 列出的修正版本。

2. 降低 NTLM 雜湊外洩的價值（以下為通用強化措施，非本漏洞專屬）：

  • 在邊界防火牆封鎖工作站對外的 SMB（TCP 445），可行的話一併限制對外 WebDAV。
  • 將高權限帳號加入 Protected Users 群組（無法使用 NTLM）。
  • 先稽核、再限制對外 NTLM（「網路安全性：限制 NTLM：連到遠端伺服器的傳出 NTLM 流量」）。
  • 強制 SMB 簽章並啟用 EPA（Extended Protection for Authentication），提高中繼攻擊難度。

3. 主動獵捕：

  • 找出 OUTLOOK.EXE 對外部 IP 的 445 連線或 WebDAV 流量（Sysmon 事件 ID 3 或 EDR 網路遙測）。
  • 檢查防火牆記錄中使用者網段的對外 445 嘗試——即使被擋下也是警訊。
  • 留意使用者開啟郵件附件後，來源異常的 NTLM 登入（事件 ID 4624，驗證套件為 NTLM）。
  • 以附件形式寄來、非預期的 .msg 等 Outlook 郵件檔應視為可疑。

4. 接著依序處理： 網域控制站（AD DS）、Exchange、對外服務主機（Schannel）與 SharePoint。

參考來源

English version

By Shar Z, Security Engineer at Nine-Security

Microsoft's November 2026 Patch Tuesday (November 10) is another huge release. Tenable counts 1,093 CVEs, SecurityWeek counts 1,094, and BleepingComputer reports 1,235; the totals differ depending on what each outlet includes. Only one bug is confirmed as exploited in the wild, and it is the one most defenders should look at first: CVE-2026-124194, a Microsoft Outlook spoofing flaw that hands an attacker the victim's NTLMv2 hash.

What happened

According to Microsoft's advisory, as quoted by SecurityWeek and BleepingComputer, "an unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning."

That outbound connection carries the user's NTLMv2 authentication. An attacker who captures it can try to crack it offline or relay it to impersonate the user.

Key facts from the sources:

  • Severity: Microsoft rates it Moderate, CVSS 6.5. Don't let the score fool you: it is confirmed exploited, and stolen NTLM hashes are a common first step toward account takeover and lateral movement.
  • User interaction is required: the victim has to open the file. Microsoft says it cannot be triggered through the Preview Pane.
  • Affected products: Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 (per SecurityWeek).
  • Not publicly disclosed before the fix. Microsoft gave no details about the attacks it observed.
  • Credit: a researcher using the handle "nono" and Benoît Sevens; Microsoft's acknowledgement notes Sevens used Anthropic's Claude.

Other bugs worth prioritizing this month

From Tenable's analysis:

  • CVE-2026-118146, Active Directory Domain Services RCE (CVSS 8.8, Critical, "Exploitation More Likely"), needs authentication.
  • CVE-2026-118207, Exchange Server RCE (CVSS 8.8, Critical, "Exploitation More Likely"), needs authentication.
  • CVE-2026-119952, Windows Schannel RCE (CVSS 8.1, Critical), unauthenticated, "Exploitation More Likely."
  • CVE-2026-120002, SharePoint Server elevation of privilege (CVSS 9.9, Important).
  • CVE-2026-113862, Windows NAT RCE (CVSS 8.1, Critical).

SecurityWeek also notes this is the last security update for Windows 11 23H2 Enterprise and Education. Those devices get no more monthly fixes after this.

What to do now

1. Patch Outlook / Microsoft 365 Apps first. Push the November Office updates and confirm Click-to-Run clients actually moved to the fixed build listed in the MSRC Update Guide entry for CVE-2026-124194.

2. Reduce what a leaked NTLM hash is worth. These are standard hardening steps, not specific to this CVE:

  • Block outbound SMB (TCP 445) and, where you can, outbound WebDAV from workstations to the internet at the perimeter firewall.
  • Put privileged accounts in the Protected Users group, which can't use NTLM.
  • Audit, then restrict, outgoing NTLM ("Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers").
  • Require SMB signing and turn on Extended Protection for Authentication (EPA) to make relay harder.

3. Hunt for it.

  • Look for OUTLOOK.EXE making network connections to external IPs on 445, or WebDAV traffic (Sysmon Event ID 3, or your EDR's network telemetry).
  • Check firewall logs for outbound 445 attempts from user subnets. Blocked attempts are still a signal.
  • Watch for NTLM logons (Event ID 4624 with NTLM authentication) from unusual sources shortly after a user opened an email attachment.
  • Treat unexpected .msg or other Outlook message files arriving as attachments as suspicious.

4. Then work through the rest: domain controllers (AD DS), Exchange, internet-facing servers (Schannel), and SharePoint.

Sources