Microsoft’s November security release is very large, with most outlets counting about 1,090 vulnerabilities and 63 rated critical. Only one was being exploited before the fix: an Outlook flaw tracked as CVE-2026-124194.
The Outlook flaw
An attacker sends a specially prepared message file. When the victim opens it, Outlook connects to a network location the attacker controls without showing its usual warning about external content. That connection can expose the user’s NTLMv2 hash, which can then be relayed or cracked to impersonate them.
It is rated 6.5, classed as spoofing, and it is not zero-click: the file has to be opened, and the Preview Pane is not an attack path. Affected products are Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on 10 November, with a remediation date of 24 November for US federal agencies.
The rest of the release
Counts differ by source and method, from about 1,090 to more than 1,200. One analysis notes roughly 30 issues that could spread between systems without user action. The volume alone makes prioritisation the real task this month.
What to do
- Patch Office first on machines used by people who handle external email.
- Verify installed build numbers; do not rely only on deployment reports.
- Block outbound SMB (TCP 445) at the perimeter so leaked hashes have nowhere to go. This also limits a whole class of similar bugs.
- Where possible, restrict or disable NTLM.
For OT environments
Engineering workstations with Office installed are in scope. If they cannot be patched this cycle, the outbound SMB block and keeping email off those machines are the controls that matter.