Microsoft released its November 2026 Patch Tuesday updates on 10 November. BleepingComputer counted 1,235 fixed flaws, after 1,411 in October, and said one Outlook flaw was already exploited. Its count leaves out 108 flaws fixed earlier in the month. Qualys also counted 1,235, CrowdStrike counted 1,252, and SANS counted 1,260.
The Outlook flaw is CVE-2026-124194. Microsoft said an attacker could send a crafted message file and persuade a user to open it. Outlook then connects to the attacker's server without the usual external-content warning. BleepingComputer said Windows may try to sign in there automatically, handing over the user's NTLMv2 hash, a scrambled login proof. CrowdStrike said the hash can be relayed or cracked offline to pose as the user. Microsoft said the Preview Pane is not a way in. Qualys said CISA asked for patching by November 24. The sources do not say who the attackers are or how many people were hit.
The harm here is stolen logins, not code running on a machine. CrowdStrike rated the flaw Moderate, at 6.5, but said real-world exposure is broader than that score suggests. Two questions for budget owners: do we still let Windows send NTLM sign-ins to outside servers, and can we deploy the Outlook fix before November 24?