Microsoft has issued its November 2026 Patch Tuesday security updates, addressing a record-breaking total of 1,235 vulnerabilities, including one actively exploited zero-day flaw in Microsoft Outlook.
The updates include 66 Critical vulnerabilities, of which 48 enable Remote Code Execution, 15 involve Elevation of Privilege, and three are Use-After-Free issues in the Chromium-based Microsoft Edge. The breakdown of vulnerability categories shows 536 Elevation of Privilege flaws, 296 Remote Code Execution issues, 157 Information Disclosure problems, and 142 vulnerabilities specific to Microsoft Edge.
Of the total, roughly 639 vulnerabilities impact Windows and related Microsoft products. The company excludes 108 additional flaws fixed earlier in the month from this count, covering Entra Device Registration, Mariner, and Edge components.
Zero-Day Outlook Spoofing Vulnerability
Microsoft patched the actively exploited zero-day CVE-2026-124194, a Microsoft Outlook Spoofing Vulnerability. An unauthenticated attacker can send a specially crafted message file that causes Outlook to connect to an attacker-controlled network location, disclosing NTLM authentication hashes without displaying the usual external-content warning.
This NTLM credential disclosure flaw has been used in phishing campaigns where malicious attachments trigger automatic authentication attempts to remote servers controlled by attackers, potentially allowing offline cracking of NTLMv2 hashes and subsequent account impersonation.
Other November 2026 Vendor Updates
- Barracuda Networks released fixes for two root-privilege vulnerabilities later exploited in attacks.
- Cisco addressed critical flaws in Catalyst SD-WAN Controller, Secure Email Gateway, and Meraki products.
- Google issued emergency Chrome updates for a new zero-day exploit.
- Ivanti patched two Connect Secure remote access flaws chained in attacks since October.
- SonicWall fixed seven SonicOS issues, including an SSL-VPN authentication bypass exploited in the wild.
- Zyxel addressed a zero-day in GS1900 series switches used to compromise nearly 1,000 devices.
Additional updates came from SAP, N-able, Vates Xen Orchestra, and multiple Linux distributions addressing an OpenSSH and musl authentication bypass known as *sshole*.
