Ing. Calogero Bono
Microsoft has released its November 2026 Patch Tuesday with a record number of fixes. The count varies by source, 1,094 according to The Register and 1,235 according to BleepingComputer. A single flaw, in Outlook, was already being exploited by attackers before the patch. It matters because getting a user to open a file is enough to steal their network credentials, and because the volume of bulletins now puts pressure on anyone managing systems.
A few terms before we get into the facts. Zero-day is a flaw with no official fix at the moment it is discovered or exploited. NTLMv2 hash is the password fingerprint Windows uses to authenticate on the network, and if it is stolen it can be used to impersonate the user. CVSS is the severity score from 0 to 10. RCE stands for remote code execution. Zero-click indicates a flaw that can be exploited without the victim doing anything.
What does the Outlook zero-day do?
The flaw is a spoofing issue in Outlook, tracked as CVE-2026-124194, with a CVSS score of 6.5 out of 10. According to The Register, Microsoft has marked it as exploited but has not said since when, by whom, or against what targets.
Microsoft warns that an unauthenticated attacker could send a message file and persuade the user to open it. Outlook then connects to a network location controlled by the attacker without showing the usual warning about external content.
Why is the risk higher than the name suggests?
Dustin Childs, of the Zero Day Initiative at TrendAI, warns that the name is misleading. For him, "the label is spoofing, but the impact is bigger than the name suggests".
BleepingComputer explains the mechanism. Windows may try to authenticate to the remote server and expose the NTLMv2 hash, which the attacker can capture and then try to crack offline. The recovered credentials could be used to access corporate accounts. Similar flaws have been exploited in the past with phishing attachments.
How many flaws did Microsoft fix and why don't the numbers match?
The Register reports 1,094 fixes, with October at 1,474. BleepingComputer counts 1,235 flaws, after October's 1,411, and explains that it includes only those released on the Patch Tuesday day, excluding 108 fixed earlier. The counting criteria differ.
According to BleepingComputer, 66 flaws are critical, 48 of them remote code execution. The outlet links the record numbers to Microsoft's use of AI to find and fix vulnerabilities. On a related topic, see also OpenAI's GPT-6 Cyber and the 81 flaws in Firefox 159.
Which zero-click flaws should be fixed first?
Two critical flaws have a CVSS of 9.8. CVE-2026-116928 is an out-of-bounds write in the Windows search component. According to Microsoft, Exchange processes the attachment for indexing, so the recipient does not need to open anything.
CVE-2026-119958 concerns the Windows LDAP implementation and can hit domain controllers with purpose-built requests. Childs also counts 30 flaws at risk of being "wormable", meaning requiring neither authentication nor interaction. He further points to CVE-2026-112967, a heap overflow in the Xbox Live Networking service, also rated 9.8.
Limits to know
We do not know when the attacks on Outlook began, who is behind them, or what they do after gaining access. Microsoft has not said, according to The Register. The totals of flaws differ between sources and we cannot establish which one is the reference. The Microsoft Learn document describes how Defender handles zero-days in general and does not comment on this bulletin. Further details may come in the coming days.
What changes for those working in digital
If you use Outlook, install the update right away and remind users not to open unexpected message files. With the patch now public, The Register notes that other attackers can analyze it to build their own exploits. Prioritize Exchange and domain controllers, as Childs suggests, and isolate exposed network services such as DNS and DHCP. According to Microsoft Learn, once the patch is released the recommendation in Defender switches to Update and the zero-day tag disappears. If you manage servers for clients, a hosting with managed security updates takes some of this work off your hands.
Our take
November's numbers show that the old method, reading the bulletin and fixing everything, no longer works. With over a thousand flaws a month you need to decide first what really matters. The Outlook zero-day has an average score but a concrete impact, because it leads to stolen credentials. The CVSS score alone is a weak guide. It has to be cross-checked with exploitation status and system exposure. It is also striking that Microsoft remains sparing with details about the attacks.
Frequently asked questions
How many zero-days did Microsoft fix in November 2026?
Just one, in Outlook, with identifier CVE-2026-124194. It was being exploited in attacks before the patch. According to The Register, none of the other flaws is listed as publicly known.
What risk does someone who opens the malicious file face?
They can lose their account's NTLMv2 hash. The attacker can use it to impersonate the user, after cracking it offline according to BleepingComputer. A network connection and user interaction are required.
Why do the sources report different numbers of flaws?
They use different criteria. The Register reports 1,094 fixes, BleepingComputer 1,235. The latter says it counts only the flaws released on the Patch Tuesday day itself.
What does zero-click mean?
That the flaw can be exploited without the user opening or clicking anything. In the case of CVE-2026-116928, Exchange processes the attachment on its own to index it. This is why Childs recommends fixing Exchange first.
How does Defender flag zero-days?
With a Zero day tag on vulnerability, software and recommendation pages. When the patch arrives, the recommendation becomes Update and the tag is removed. Defender only shows zero-days it has information about.
What to watch for in the weeks after Patch Tuesday
Details about the Outlook attacks have yet to emerge. In the meantime, it is worth preparing a prioritization method that will hold up for the next bulletin too.
- Follow reports on who is exploiting CVE-2026-124194 and how, and adapt your mail defenses accordingly.
- Check whether Exchange and domain controllers are actually updated, not just scheduled to be.
- Prepare a written priority rule for upcoming bulletins, based on exploitation and exposure.
