Microsoft Patch Tuesday fixes 1,094 bugs, including exploited Outlook flaw

Microsoft's November Patch Tuesday release fixes 1,094 bugs across its products, including an Outlook spoofing flaw already exploited by attackers. The update also includes two zero-click critical vulnerabilities and a critical Xbox Live Networking Service flaw.

Exploited Outlook flaw

The Outlook issue, CVE-2026-124194, carries a CVSS rating of 6.5. Dustin Childs warned that the spoofing label understates its impact. An attacker sends a specially crafted message file and convinces a user to open it; Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, disclosing the user's NTLMv2 hash. The attacker can use that hash to authenticate as the user. Microsoft marked the flaw as exploited but did not say when attacks started, who is using it, or what attackers do after exploitation. Childs said other miscreants may scan for vulnerable versions and reverse engineer the patch now that a fix is public, so administrators should prioritize it and watch inboxes for suspicious files.

Zero-click threats

Two critical flaws, CVE-2026-116928 and CVE-2026-119958, each have a 9.8 CVSS rating and require no user interaction. CVE-2026-116928 is an out-of-bounds write in the Microsoft Windows Search Component that could lead to remote code execution. An unauthenticated attacker could abuse the search feature in Exchange by sending an email with a specially crafted attachment; Exchange automatically processes the attachment for indexing, so the recipient does not need to open the email or attachment. Successful exploitation could allow the attacker to execute code with the permissions of the affected processing service. CVE-2026-119958 is an out-of-bounds write in Windows' implementation of LDAP that could allow unauthenticated attackers to execute code remotely without user interaction, by sending specially crafted LDAP requests to vulnerable systems and potentially compromising domain controllers. Childs also counted 30 CVEs with wormable risk, requiring zero authentication and zero user interaction over a network.

Back-to-back CVE volume

October had 1,474 CVEs, making this the second straight month with more than 1,000. CVE-2026-124194 is the only one under active exploitation, and none of the 1,094 is listed as publicly known. Childs said that should not give false comfort. He said logging back-to-back months above 1,000 CVEs proves automated bug-hunting has permanently reset patch volume, and that AI is making patch-diffing and exploit generation near-instant, so the threat window opens when updates drop. Defenders should abandon broad triage and take immediate defensive action: patch Exchange and Domain Controllers first, ring-fence exposed network services such as DNS and DHCP, and verify manual administrative fixes on cloud services.

Xbox service flaw

A critical flaw in the Windows Xbox Live Networking Service, CVE-2026-112967, could allow remote code execution. It is a heap-overflow vulnerability with a 9.8 CVSS rating that does not require authentication or user interaction. Administrators should include vulnerable Windows systems running the service in their patching plans.

Sources: The Register