Microsoft Fixes 1,092 Flaws in November Patch Tuesday, Including Exploited Outlook NTLM Leak

Microsoft's November Patch Tuesday release arrived with 1,092 vulnerabilities fixed across its products, and one of them is already being used against real targets. Rapid7 says that flaw, a spoofing bug in classic Outlook, is the only one Microsoft has marked as exploited this month.

Adam Barnett, Lead Software Engineer at Rapid7, walked through the release. He cited 1,102 Windows vulnerabilities and said the volume remains unusually high, even after several recent months of large releases. The two figures differ in the source material, and the report does not explain the gap.

The exploited flaw is CVE-2026-124194. According to Barnett, opening a specially crafted malicious file can make Outlook connect silently to an attacker-controlled location and leak the user's NTLM v2 hash. It affects all supported versions of classic Outlook. Its CVSS base score is 6.5, which Barnett said understates the practical risk: an attacker holding the hash could use it to impersonate the user against another service, or crack the credentials offline. One mitigating detail is that the Preview Pane is not a vector, which may limit its impact in practice.

Barnett compared the flaw to a postcard that arrives in the mailbox, looks like marketing material and is thrown away, while the reader has unknowingly sent photographs of their front door key to a stranger. His point was that a malicious file in an Outlook inbox can do the equivalent.

Rapid7 also flagged CVE-2026-119952, a pre-authentication remote code execution vulnerability in Windows. An attacker could run code on a target system by sending specially crafted malicious packets. The vulnerable component is Schannel, Microsoft's implementation of Transport Layer Security, which Barnett said may widen the pool of exposed endpoints. Microsoft's advisory notes that specific conditions are required for exploitation. Still, Microsoft's assessment that exploitation is more likely suggests reliable exploit code may be achievable, Barnett said, and in many cases an attacker may not need an existing foothold on the same subnet.

A third flaw, CVE-2026-116928, could allow pre-authentication remote code execution on an Exchange server. The route is a malicious attachment that Windows Search processes automatically on Exchange's behalf. The problem lies in the interaction between Exchange on Windows and the Windows Search component, so the patches apply to Windows rather than to Exchange itself. Barnett asked whether someone could take control of an Exchange server with a single email and answered that, in short, yes. He also noted that organisations should be running Exchange Subscription Edition, since earlier Exchange versions are out of support.

On the wider numbers, Barnett said monthly patching at this scale would have seemed implausible only a few months ago, and that this month felt like a slight reprieve even though the total still tops 1,000. He questioned whether more fixes necessarily mean better security, arguing that each code change made to remove a known flaw could introduce new weaknesses for researchers or attackers to find later. He also observed that the number of Microsoft vulnerabilities known to be exploited has not risen in step with the patch count. Microsoft reported no publicly disclosed vulnerabilities this month and identified exploitation for just one.

Lifecycle changes were lighter than the previous month. .NET 8 Long Term Servicing, PowerShell 7.4 LTS, and Windows 11 Enterprise, Education and IoT editions have moved past their release end dates.

For administrators, the practical priorities are the exploited Outlook fix, the Schannel and Windows Search patches, and confirming that any Exchange servers are on a supported edition.