Microsoft patches 1,094 flaws in November update, including an exploited Outlook bug
Microsoft's November Patch Tuesday, released November 10, fixes 1,094 flaws including 63 rated Critical. The one already being exploited is an Outlook bug that can leak a login hash, and CISA has ordered federal agencies to fix it by November 24.
The News
Microsoft released its November 2026 Patch Tuesday update on Tuesday, November 10, fixing 1,094 security flaws across its products. Sixty-three of those flaws were rated Critical — the highest severity rating, meaning they could let an attacker take over a system with relatively little effort. For most users and IT teams, this is a routine monthly security release, but one flaw in the batch was already being used in real attacks.
The exploited flaw is CVE-2026-124194, a spoofing bug in Microsoft Outlook. It is rated Moderate, with a severity score of 6.5 out of 10, but that rating understates the risk: opening a specially crafted message file can leak a user's NTLMv2 hash — a scrambled version of the password a Windows computer uses to prove who you are on a network. An attacker who steals that hash can try to reuse it to log in as the victim elsewhere. Microsoft says the Preview Pane — the small window that shows an email without fully opening it — is not an attack route here; the message file itself has to be opened.
The fix for the Outlook flaw does not arrive in the usual Windows update. It ships in the Microsoft 365 Apps and Office LTSC updates, so organisations that only install the Windows cumulative update will still be exposed. The same day, the US Cybersecurity and Infrastructure Security Agency (CISA) added the Outlook flaw to its Known Exploited Vulnerabilities catalogue — a list of flaws federal agencies are ordered to fix — with a November 24 deadline. It added five other exploited flaws at the same time, including a Chrome use-after-free bug (CVE-2026-125350, fixed in Chrome version 157.0.8103.50/.51) and two flaws in Barracuda products.
This is a different batch from the one covered in yesterday's AI Agent Update story. That item covered a separate four-flaw CISA batch with a November 12 deadline for federal agencies. Today's story is the broader Patch Tuesday release itself, plus a different six-flaw set of actively exploited vulnerabilities added to the CISA catalogue on November 10.
A 1,094-flaw patch release with one bug already being exploited — the fix is out, but it lives in the Office update, not the Windows one.
Why It Matters
The size of the release is the first thing to notice: 1,094 flaws in one monthly update is a very large number, even for Microsoft, and 63 of them are Critical. Most of those flaws will never be used in an attack, and patching them is ordinary hygiene. But the Outlook flaw shows why the monthly ritual matters — it was already being exploited before the patch arrived, and the thing it steals, a password hash, is exactly the kind of credential attackers reuse to move deeper into a network.
The delivery quirk matters too. Many IT teams treat the Windows cumulative update as the whole job, and this fix is not in it. The Outlook patch lives in the Microsoft 365 Apps or Office LTSC update, which some organisations apply on a slower schedule. Until that update lands, opening a crafted message file can still leak a hash. The November 24 CISA deadline applies to federal agencies, but it is a useful yardstick for everyone else: two weeks to close a flaw that is already being exploited.
For investors, the read-through is mixed. A big patch release with an exploited flaw is a reminder that the attack surface keeps growing, which supports demand for Microsoft's own security tools and for Google's Chrome updates — Chrome's exploited flaw was patched the same day. But it is also a reminder that even the biggest software makers ship flaws that attackers find first. Microsoft shares closed Tuesday at $533.16, down 2.20%, and Alphabet closed at $287.38, down 0.27% — a broad market down day rather than a reaction to the patch release itself.
Analyst's Take
Our call is Mixed. The exploited Outlook flaw is a genuine negative — an actively used bug that can leak login credentials — but the patch is out, the flaw is rated Moderate rather than Critical, and the rest of the release is routine maintenance on a very large scale. The risk is real but contained, and it is fixable with updates that already exist.
What to watch: whether CISA reports federal agencies meeting the November 24 deadline, and whether any public reports emerge of the Outlook flaw being used beyond the exploitation CISA has already confirmed. The more important test is quieter: whether organisations actually install the Office update that carries the fix, not just the Windows one.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is Patch Tuesday?
Patch Tuesday is Microsoft's monthly security release, on the second Tuesday of each month. It bundles fixes for flaws found in Windows, Office and other Microsoft products into one update, so IT teams can patch everything at once.
What is a CVE?
A CVE — Common Vulnerabilities and Exposures — is a public ID number for a known security flaw. CVE-2026-124194 is the ID for the exploited Outlook bug in this release. The number lets everyone, from Microsoft to CISA, talk about the same flaw without confusion.
What is an NTLMv2 hash, and why does it matter?
An NTLMv2 hash is a scrambled version of the password a Windows computer uses to prove who you are on a network. If an attacker steals it, they can try to reuse it to log in as you on other systems — without ever knowing your actual password. That is why a leak of a hash is serious even when the password itself is not exposed.
What is CISA's Known Exploited Vulnerabilities catalogue?
It is a list kept by the US Cybersecurity and Infrastructure Security Agency of flaws that are actively being used in attacks. Once a flaw is on the list, US federal agencies are legally ordered to fix it by a set deadline — here, November 24 for the Outlook flaw.
How is this different from yesterday's CISA story?
Yesterday's story covered a separate CISA batch of four flaws with a November 12 deadline for federal agencies. Today's story is the broader November Patch Tuesday release itself — 1,094 fixes — plus a different six-flaw set of actively exploited vulnerabilities that CISA added to its catalogue on November 10. Different flaws, different deadline.
Why is the Outlook fix not in the Windows update?
Microsoft ships Office fixes separately from Windows fixes. The Outlook patch comes in the Microsoft 365 Apps or Office LTSC update, not the Windows cumulative update. Organisations that only install the Windows update will still be exposed until they apply the Office update too.
👁
Source: Splashtop