Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
Microsoft fixed 1,094 vulnerabilities, including an Outlook flaw already exploited in the wild and two critical zero-click bugs that need no user interaction.
- On Tuesday, Microsoft released patches for 1,094 vulnerabilities, including one exploited zero-day, CVE-2026-124194. This Microsoft Outlook spoofing vulnerability, rated 6.5 on the CVSS scale, allows attackers to steal NTLMv2 hashes by convincing users to open crafted message files.
- Satnam Narang, a research engineer at Tenable, noted that this release brings Microsoft's total to more than 5,160 vulnerabilities disclosed this year. This surpasses any previous year, reflecting back-to-back months exceeding 1,000 CVEs.
- Among the 63 critical vulnerabilities are two zero-click threats, CVE-2026-116928 and CVE-2026-119958, allowing remote code execution without user interaction. A 9.8-rated heap-overflow flaw in the Windows Xbox Live Networking Service, CVE-2026-112967, also poses critical risk.
- The Cybersecurity and Infrastructure Security Agency ordered federal agencies to patch Barracuda email security bugs CVE-2026-116606 and CVE-2026-111560 by Friday. Separately, N-able took hosted N-Central environments offline after researchers uncovered more than 30 serious vulnerabilities.
- Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative, warns that attackers can exploit these flaws instantly, urging defenders to abandon broad triage. He recommends prioritizing Exchange and Domain Controllers while ring-fencing exposed services like DNS and DHCP to prevent wormable spread.
24 Articles
24 Articles
Microsoft’s Second 1,000-Bug Patch Tuesday Brings an Outlook Zero-Day Found With Claude’s Help
Microsoft released fixes for 1,093 security flaws on Tuesday, its second straight monthly update above 1,000. Only one was already under attack, an Outlook bug that hands attackers a user’s NTLMv2 password hash, and Microsoft’s advisory credits its discovery in part to a researcher working with Anthropic’s Claude. The size of these releases has changed fast. A year ago, Microsoft’s November release carried 63 new CVEs assigned by the company, ac…
Microsoft's November update eliminates more than 1,000 vulnerabilities. A vulnerability in Outlook already exploits attackers. Windows 11 also gets new features.
Outlook failure is between 1,259 vulnerabilities fixed by Microsoft. See how the exploitation occurs and what are the risks.
Use Outlook? Hackers can take over your PC with a single email, you must update immediately
Cybercrooks could take control of your PC with a single email sent to Outlook. Worse still, the vulnerability that enables this attack is known to hackers worldwide. This is known as a "zero-day flaw" because there are zero days before the secret is out, meaning it's a race against time to update your device with the fix before cybercriminals attack you.Without the fix, mistakenly opening a malicious email is enough to let hackers wrest control …
Outlook security flaw is already being exploited by hackers. Windows login credentials could be at risk. Here's how to protect yourself.
Coverage Details
Bias Distribution
- 50% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
