Microsoft’s November Patch Tuesday Fixes 1,094 CVEs by Its Own Count, Not a “Record” 1,235, and the Only Exploited Bug Is an Outlook Flaw That Can Leak an NTLMv2 Hash Without the Usual Warning

Microsoft’s November 2026 security release, published on Tuesday, November 10, covers 1,094 CVEs by Microsoft’s own count, and one of them was already being exploited: CVE-2026-124194, an Outlook spoofing flaw that can disclose a user’s NTLMv2 password hash. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog the same day, with a due date of November 24. We read Microsoft’s public CVRF feed (the machine-readable record behind the Security Update Guide), the National Vulnerability Database (NVD) record, CISA’s KEV feed, Microsoft’s Office build table, and the coverage from BleepingComputer, The Register and the Zero Day Initiative (ZDI), and we recounted the release ourselves. This is a snapshot from November 11, between about 19:00 and 19:30 UTC; Microsoft revises the feed through the month.

Three facts frame it. First, the exploited bug is rated only Moderate (CVSS base score 6.5), yet it hands over a credential hash, and Microsoft’s FAQ says the Preview Pane is not an attack vector, so a user has to open the file. Second, the headline counts disagree: Microsoft and The Register say 1,094, ZDI says about 1,090, and BleepingComputer reports “a record-breaking 1,235 flaws,” a figure that includes 142 Edge flaws and is not a record even by that outlet’s own October number. Third, the exploited bug is not the only one that needs a patch window this week: 42 CVEs carry Microsoft’s “Exploitation More Likely” label for the latest software, and five of them are rated Critical, among them a Microsoft Exchange Server code-execution flaw.

The exploited Outlook bug

Microsoft’s record for CVE-2026-124194 says an unauthenticated attacker “could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.” Opening it “could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user.” A second FAQ entry says what leaks: “This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.” BleepingComputer adds that such a hash can be “captured by the attacker and potentially cracked offline.”

What the records leave out is as telling as what they say. Microsoft does not say who is exploiting the flaw, since when, or how widely, and The Register notes the same gap: Microsoft “didn’t say when the attacks started, who is battering this bug, and what they are doing with the access post exploitation.” The first of those credits also appears among the four on October’s exploited bug, CVE-2026-96951, a Windows Shell security feature bypass. A credit line says who reported a bug, not who saw it exploited, and Microsoft has not said how the attacks were detected. ZDI’s Dustin Childs, quoted by The Register, puts the mismatch between the label and the risk this way: “It’s labeled spoofing, but the impact is bigger than the name suggests.”

Which Outlook builds carry the fix

Microsoft’s Microsoft 365 Apps security updates page lists the November 10 builds, and CVE-2026-124194 appears under Outlook in that release. The two volume-licensed editions in the CVE’s product list get the same builds that Microsoft’s feed names as fixed (16.0.17932.21140 and 16.0.14334.21048); the subscription channels get version 2610 builds or the matching builds of the older monthly versions.

Office 2019 Volume Licensed (Version 1808, Build 10417.20236) is in the same release, but the CVE’s record lists no Office 2019 entry. To see what a machine runs, Microsoft’s support page says to choose File in classic Outlook, then Office Account (or Help if you do not see it): “The Outlook version and build number is under Product Information.”

What to do besides updating

The record for this bug lists no mitigation, so what follows is our reading of Microsoft’s guidance for an earlier Outlook NTLM leak, CVE-2023-23397, and it may not map one to one. That 2023 flaw was triggered by “a UNC path to an SMB (TCP 445) share on a threat actor-controlled server on an untrusted network” and needed no user interaction. The new bug needs a user to open a file, and Microsoft’s FAQ does not name the protocol. In its 2023 investigation guide, Microsoft listed practices for sites that could not patch at once, among them: “Add users to the Protected Users group, which prevents the use of NTLM as an authentication mechanism. This might impact applications that require NTLM,” and “Block TCP 445/SMB outbound from your network by using a perimeter firewall, local firewall, and through your VPN settings.” The same guide also shows a WebDAV route (the WebClient service starting rundll32.exe with davclnt.dll), which suggests that blocking port 445 alone did not cover every path then and may not now.

• Update first, then confirm the build as above. Microsoft’s record marks customer action as required.
• Block outbound TCP 445 at the perimeter and for remote users, as Microsoft advised in 2023, and watch for outbound WebDAV connections from Outlook hosts if you log them.
• Test the Protected Users group on high-value accounts before relying on it: Microsoft Learn lists “Authenticate with NTLM authentication” among the things its members are “unable to do.”
• Treat the password of anyone who opened an unexpected message file from outside as exposed, because a captured NTLMv2 hash can be cracked offline or used to authenticate as the user.

Why three counts for one Patch Tuesday

The release notes in Microsoft’s feed say “This release consists of 1094 Microsoft CVEs,” and the product table beneath adds up to the same 1,094 (Windows 726, Office 174, SQL Server 59, Developer Tools 53, SharePoint Server 27, Other 25, Azure 20, Exchange Server 9, Defender 1). The Register reports 1,094. ZDI writes that “the overall count is a bit confusing” and that it sees “about 1,090 new CVEs released today,” adding “Well, at least it’s not a new record for Microsoft.” BleepingComputer reports 1,235.

BleepingComputer also reports 66 Critical flaws, “48 of which are Remote Code Execution (RCE), 15 are Elevation of Privilege (EoP), and three are Use-After-Free in Microsoft Edge.” The feed has 63 Critical CVEs, 48 and 15 by type, so the extra three are Edge bugs too, which is how its totals and ours reconcile. The outlet says it counts only vulnerabilities “released by Microsoft on Patch Tuesday itself,” yet the feed dates the Chromium CVEs for Edge to November 4 and 5. Its article also calls November’s total record-breaking while saying October brought “a record-breaking 1,411 flaws in the October updates,” so by its own figures November is not a record. By Microsoft’s own numbers it is about 22 percent below October.

Counts also move after release day. Microsoft’s October document said 1,413 when we covered it; it now says 1,474. The feed shows 59 Microsoft-assigned CVEs first published after October 13, 33 of them on October 15, which fits the growth. Treat any Patch Tuesday count as a floor; November’s 1,094 may rise too. Using the rule from our October post (Microsoft as numbering authority, first published on the month’s Patch Tuesday), the 2026 series looks like this:

These match the October table within one or two (September 972 against 973, October 1,408 against 1,409) because the feed is revised. November is the second-largest month of the year; Critical ratings fell from 113 in September to 77 and 63; and since July the number flagged as exploited has stayed between one and three a month while volume rose from 571 CVEs to 1,093.

Most of the drop from October is Windows. Microsoft’s release-notes tables, as the two documents read on November 11, credit Windows with 726 CVEs in November against 1,105 in October, while SQL Server went from 22 CVEs in 8 updates to 59 in 13:

What else to patch first

Each CVE in the feed carries an exploitability label for the latest software release. In November, 42 are marked “Exploitation More Likely” (34 elevation of privilege, 5 remote code execution, and one each of information disclosure, security feature bypass and denial of service), one is “Exploitation Detected,” and 978 are “Exploitation Less Likely.” October’s release had 103 More Likely by the same rule. Five of November’s 42 are rated Critical:

Separately, 15 of the 63 Critical CVEs need no account and no user interaction over the network according to their CVSS vectors: five in Message Queuing (CVE-2026-109459, CVE-2026-116710, CVE-2026-119963, CVE-2026-119964 and CVE-2026-119967), the NAT and Schannel flaws above, and one each in Windows Search, LDAP, IIS, CredSSP, the RPC runtime, Windows Deployment Services, the Xbox Live Networking Service and Azure OpenAI. Eleven of the 15 are rated attack complexity high, and only the NAT and Schannel ones carry the More Likely label. Exchange administrators should note that the Critical bug is one of nine Exchange CVEs this month; the other eight are rated Important. The 54 CVEs the feed files under the SQL Server product family are all Important, 22 of them elevation of privilege and 20 remote code execution.

What the credit lines say about AI

Credit lines that name an AI tool or company were on 75 of November’s 1,093 CVEs (6.9 percent), against 116 of October’s 1,408 (8.2 percent) under the same filter, which looks for Diffract, GLM from z.ai, Xint, XBREACH.AI, Armadin, OpenAI or Codex, and Anthropic or “using Claude.” October’s figure is 116, not the 118 in our October post, because the pattern list changed and the feed was revised. Diffract was credited on 44 CVEs (85 in October), GLM from z.ai on 19 (16), Anthropic on 5 (1), Xint on 5 (5), XBREACH.AI on 2 (6) and Armadin on 1 (4); no credit line matched OpenAI or Codex in either month. Four of the five Anthropic credits read “Xinyang Ge with Anthropic.” Credit lines are self-descriptions that reporters choose to include, so they show disclosed tool use, not how every bug was found.

What we could not establish

• Who is exploiting CVE-2026-124194, since when and against whom. Microsoft’s record is silent, and we found no public write-up of the attacks.
• Which protocol the connection uses, SMB or WebDAV over HTTP, and so which outbound controls would stop it.
• Whether Office 2019, Outlook 2016 and the new Outlook for Windows are unaffected or simply absent from the record; none is listed.
• Whether Microsoft or the outlets will revise their counts. BleepingComputer’s article still opened with “a record-breaking 1,235 flaws” when we last read it at 19:26 UTC on November 11.

The checks we ran

The script below recounts the release from Microsoft’s feed using only the Python standard library. It downloads about 18 MB. Run on November 11, it printed the output shown after it; if Microsoft revises the feed, your numbers can drift by a few.

# cvrf_check.py: recount Microsoft's November 2026 Patch Tuesday from the public MSRC feed
# Python 3.9 or later, standard library only. Downloads about 18 MB.
import collections
import json
import re
import urllib.request

URL = "https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Nov"
PATCH_TUESDAY = "2026-11-10"

request = urllib.request.Request(URL, headers={"Accept": "application/json", "User-Agent": "cvrf-check/1.0"})
doc = json.load(urllib.request.urlopen(request, timeout=180))


def text(html):
    return re.sub(r"\s+", " ", re.sub(r"<[^>]+>", " ", html or "")).strip()


def note(vuln, kind):
    return next((n["Value"] for n in vuln.get("Notes", []) if n.get("Type") == kind), None)


def first_published(vuln):
    return min(r["Date"][:10] for r in vuln["RevisionHistory"])


def threats(vuln, kind):
    return " ".join(text(t["Description"]["Value"]) for t in vuln.get("Threats", []) if t.get("Type") == kind)


headline = re.search(r"consists of (?:the following )?(\d+) Microsoft CVEs", text(doc["DocumentNotes"][0]["Value"]))
print("release notes say:", headline.group(1), "Microsoft CVEs")

vulns = doc["Vulnerability"]
print("entries in the feed:", len(vulns))
ours = [v for v in vulns if note(v, 8) == "Microsoft" and first_published(v) == PATCH_TUESDAY]
print("Microsoft-assigned, first published " + PATCH_TUESDAY + ":", len(ours))
chrome = collections.Counter(first_published(v) for v in vulns if note(v, 8) == "Chrome")
print("Chrome-assigned entries (Edge):", sum(chrome.values()), dict(sorted(chrome.items())))
print("rated Critical:", sum("Critical" in threats(v, 3) for v in ours))
print("Exploitation More Likely:", sum("Latest Software Release:Exploitation More Likely" in threats(v, 1) for v in ours))
for v in ours:
    if "Exploited:Yes" in threats(v, 1):
        credits = [text(" ".join(x["Value"] for x in a["Name"])) for a in v.get("Acknowledgments", [])]
        print("exploited:", v["CVE"], text(v["Title"]["Value"]), "|", threats(v, 3).split()[0], "|", "; ".join(credits))

Output:

release notes say: 1094 Microsoft CVEs
entries in the feed: 1362
Microsoft-assigned, first published 2026-11-10: 1093
Chrome-assigned entries (Edge): 165 {'2026-11-04': 24, '2026-11-05': 141}
rated Critical: 63
Exploitation More Likely: 42
exploited: CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability | Moderate | Benoit Sevens using Claude with Anthropic; nono

We also compared the NVD and CISA KEV entries (catalog version 2026.11.10) with the feed, read the Office build table and the Outlook support page on November 11, and checked every quoted passage in this article against the saved source text.

Sources

• Microsoft Security Response Center CVRF feeds for November 2026 and October 2026, and the Security Update Guide entry for CVE-2026-124194
• The NVD record and the CISA KEV feed (catalog 2026.11.10)
• Microsoft 365 Apps security updates and What version of Outlook do I have?
• Microsoft’s 2023 material on CVE-2023-23397: the MSRC announcement and the investigation guide, plus Microsoft Learn on the Protected Users group
• Coverage: BleepingComputer, The Register and ZDI’s November review
• Our earlier posts on October 2026 Patch Tuesday and the September release