Microsoft's November Patch Tuesday Fixes a Record 1,235 Flaws, and the One Being Exploited Makes Outlook Leak NTLM Hashes. Would You See an Outbound Authentication Attempt to an Unknown Server?

Microsoft's November 2026 Patch Tuesday fixed what BleepingComputer calls a record-breaking 1,235 flaws, including one actively exploited zero-day: CVE-2026-124194, a Microsoft Outlook spoofing vulnerability used in attacks to steal NTLM account hashes. According to BleepingComputer, published 10 November 2026, the total excludes 108 flaws fixed earlier in the month, and 66 of the vulnerabilities are rated Critical. The October release was reported at 1,411 flaws.

What is known about the Outlook zero-day

• What it does: per Microsoft's description as quoted in the report, an unauthenticated attacker could send a specially crafted message file and convince a user to open it. Doing so could make Outlook connect to an attacker-controlled network location without showing the usual external-content warning, potentially disclosing authentication information.
• What is leaked: the report describes it as an NTLM credential disclosure flaw. Windows may authenticate automatically to the remote server, exposing the user's NTLMv2 hash, which an attacker can capture and attempt to crack offline or relay.
• What it needs: network connectivity and user interaction. Opening the file is the trigger.
• Gaps in the public detail: the report names only "an affected version of Microsoft Outlook" and gives no CVSS score, so check Microsoft's own advisory for affected builds and severity.

The numbers, and why the headline is not the priority

The report breaks the 1,235 flaws down as 536 elevation of privilege, 296 remote code execution, 157 information disclosure, 46 denial of service, 27 security feature bypass, 22 spoofing and 142 Microsoft Edge (Chromium) flaws. Those category counts do not sum exactly to the stated total, and the report does not explain the difference, so treat the breakdown as approximate.

A number this large is hard to act on as a whole. Only one flaw is confirmed exploited, and it is not a "critical remote code execution" bug. It is a quiet credential leak that depends on a user opening a file. That is the kind of issue that is easy to leave in a patch queue behind louder items.

The same report lists vendor advisories published around the same time, several of which we have covered: the SonicWall SSL-VPN bypass, the OpenSSH *sshole flaw and the N-able N-central disclosure. It also mentions an exploited Xen Orchestra authentication bypass, an exploited Zyxel GS1900 switch zero-day and an emergency Chrome update.

Why NTLM hash theft matters

An NTLMv2 hash is not a plaintext password, but it can be attacked offline if the password is weak, and in some environments it can be relayed to another service to authenticate as the user without cracking anything. Either route turns one opened message file into a foothold. The attacker never has to run code on the victim's machine, so endpoint tools that look for malware may have nothing to flag.

What does exist is a network signal: a workstation making an outbound SMB or HTTP authentication attempt to a server outside the organisation. That traffic is unusual in most environments, and it is the part defenders can look for.

What to do now

1. Install the November Microsoft Office/Outlook update on every machine, and prioritise users who receive external mail from unknown senders.
2. Block outbound SMB (TCP 445) and NTLM authentication to the internet at the perimeter. This is the control that stops a hash leaving even if a user opens the file.
3. Search mail and endpoint logs for message files (such as .msg) received from external senders in recent weeks, and for the recipients who opened them.
4. Look for outbound authentication attempts from user workstations to external addresses, and reset passwords for anyone who appears in them.
5. Reduce NTLM where you can: enforce SMB signing, prefer Kerberos, and add high-value accounts to the Protected Users group.
6. Do not let the volume stall patching. Sort the 1,235 by what is confirmed exploited and what is reachable in your environment first.

How Obiguard SOC fits

Steps 3 and 4 are a detection problem, not a patching one: someone has to notice that a laptop tried to authenticate to a host nobody recognises. Obiguard SOC streams logs and metrics from what you already run through OpenTelemetry, so firewall, DNS and endpoint events can be reviewed together rather than in separate consoles. Alerts arrive with a remediation plan split into now, this week and long-term, and its CVE Radar scans connected repositories on every push and daily, so the dependency side of a patch backlog is tracked continuously. Scope matters: SOC works from the telemetry you connect to it. It cannot see traffic that is not logged, and it does not replace installing Microsoft's update. To see how it would work on your logs, get in touch or read about Obiguard SOC.

Sources

• BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day