Microsoft November 2026 Patch Tuesday: 1,177 Flaws Fixed, an Exploited Outlook Zero-Day Leaking NTLM Hashes, and a Zero-Click Exchange Bug via Windows Search
Microsoft fixes 1,177 vulnerabilities including 64 Critical, an actively exploited Outlook spoofing flaw (CVE-2026-124194) and 9.8-rated RCEs in Windows Search, LDAP and the Xbox Live Networking Service.
Overview
Microsoft's November 2026 Patch Tuesday, released on 10 November, fixes 1,177 vulnerabilities across Windows, Office, Exchange, Azure and other products, plus 165 Chromium fixes carried into Microsoft Edge. 64 are rated Critical, 1,037 Important, 63 Moderate and 13 Low.
One vulnerability is already being exploited in the wild: an Outlook spoofing flaw that leaks users' NTLMv2 password hashes. None of the fixes was publicly disclosed before release.
If you noticed a wave of "Microsoft Windows 10" entries in the Reef Sentinel CVE feed tonight, this release is why. The CVE records started appearing at 19:22 UTC and more will keep arriving as they are processed.
The zero-day: Outlook leaks NTLM hashes (CVE-2026-124194)
CVE-2026-124194 is a spoofing vulnerability in Microsoft Office Outlook rated CVSS 6.5, and Microsoft marks it "Exploitation Detected".
- An attacker sends a specially crafted message file and convinces the user to open it in Outlook.
- Outlook then connects to an attacker-controlled network location without showing the usual external-content warning.
- That connection discloses the user's NTLMv2 hash, which the attacker can crack or relay to authenticate as the user.
- The Preview Pane is not an attack vector: the user has to open the file.
The CVSS score is moderate, but stolen NTLM hashes are a proven route to account takeover and lateral movement, especially through NTLM relay to services that don't enforce signing. Treat this as the top priority of the month. Microsoft credits the find to researchers, one of whom used an AI model in the work.
The critical flaws to patch first
Zero-click email to code execution: Windows Search (CVE-2026-116928, CVSS 9.8). An out-of-bounds write in the Windows Search component used by Exchange Server. An unauthenticated attacker sends an email with a crafted attachment, and Exchange processes it automatically for indexing, so nobody has to open anything. The attacker gets code execution with the permissions of the processing service. This is the most dangerous bug of the month for anyone running on-premises Exchange.
Unauthenticated LDAP RCE (CVE-2026-119958, CVSS 9.8). An out-of-bounds write in Windows LDAP lets an unauthenticated attacker run code in the LDAP service with a crafted set of LDAP calls. Domain controllers are the obvious high-value targets.
Xbox Live Networking Service RCE (CVE-2026-112967, CVSS 9.8). A heap-based buffer overflow that an attacker on the same network can trigger by calling arbitrary endpoints. The service ships with Windows, so it is not limited to gaming machines.
Office documents to code execution (CVSS 8.8, many CVEs). More than 20 Critical RCE flaws in Excel, Word, Outlook, PowerPoint and Office, all triggered by opening a malicious document. These remain the classic phishing payload.
Other Critical RCEs worth noting:
- Microsoft Exchange Server (CVE-2026-118207, 8.8)
- Active Directory Domain Services (CVE-2026-118146, 8.8)
- Microsoft Defender (CVE-2026-122194, 8.8)
- Windows Message Queuing (MSMQ): five Critical RCEs (8.1)
- Schannel, CredSSP, IIS, RPC Runtime and Windows Deployment Services (8.1 each)
- SMB server driver srvnet.sys, TCP/IP and Print Spooler components (7.5 each)
Hyper-V gets eight Critical elevation-of-privilege fixes, which matters for anyone running multi-tenant virtualisation.
Cloud services. Two Critical cloud CVEs need no customer action. Entra Device Registration (CVE-2026-109469, CVSS 10.0) was already fully mitigated by Microsoft and published on 5 November for transparency. Azure OpenAI (CVE-2026-119990, 9.8) is a service-side elevation-of-privilege fix.
By the numbers
- 1,177 Microsoft CVEs, plus 165 Chromium fixes for Edge
- 536 elevation of privilege, 296 remote code execution, 157 information disclosure, 46 denial of service, 27 security feature bypass, 22 spoofing, 11 tampering
- 64 Critical, 1,037 Important, 63 Moderate, 13 Low
- 1 exploited in the wild, 0 publicly disclosed before release
- 612 affect Windows 10, and 610 of those also affect Windows 11
Why the CVE feed says "Windows 10 Version 1607"
Many of tonight's entries are titled "Microsoft Windows 10 Version 1607" or "Version 1809". That is just the first product in Microsoft's affected list. Those versions are the long-term servicing builds (LTSB 2016 and LTSC 2019) that still receive updates. Almost every one of these flaws also affects Windows 11 and Windows Server, so don't assume a "Windows 10" entry leaves newer systems safe.
Windows 10 support ended in October 2025, and the one-year consumer Extended Security Updates programme ended in October 2026. Windows 10 22H2 PCs now only receive these fixes through Microsoft's commercial ESU programme. Any Windows 10 PC outside it stays exposed to all of this month's flaws.
Recommended Actions
- Patch Outlook first (CVE-2026-124194), then tell users not to open unexpected message files.
- Block outbound NTLM to the internet (SMB on TCP 445 and WebDAV) at the firewall, and add sensitive accounts to the Protected Users group to blunt hash theft.
- Patch Exchange servers immediately for the zero-click Windows Search flaw and the Exchange RCE.
- Patch domain controllers for the LDAP and AD DS RCEs, and confirm LDAP signing and channel binding are enforced.
- Roll out the Office updates to every workstation. Malicious documents remain the most common way in.
- Disable MSMQ where it isn't needed. Check for TCP port 1801 listening.
- Retire or cover Windows 10. Move remaining Windows 10 PCs to Windows 11, or make sure they are covered by commercial Extended Security Updates.
Bottom Line
November is a big release but a clear one: one exploited Outlook flaw that steals credentials, one zero-click Exchange bug, and a long list of Office and Windows RCEs. Patch Outlook, Exchange and domain controllers this week, then let the rest of the rollout follow your normal cycle.
