Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes
Microsoft released security updates addressing 1,259 vulnerabilities across its product portfolio in November 2026, marking the second straight month with over 1,000 flaws patched. The fixes cover Windows, Office, SQL Server, SharePoint Server, and Developer Tools, including 165 non-Microsoft CVEs. A Moderate-severity flaw in Microsoft Outlook tracked as CVE-2026-124194 is being actively exploited in the wild and can leak NTLMv2 hashes via specially crafted message files. CISA added the Outlook vulnerability to its Known Exploited Vulnerabilities catalog, giving federal agencies until November 24, 2026 to apply the patch. Additional remote code execution issues affect Windows Search, LDAP, Schannel, Virtual Filtering Platform, and Xbox Live Networking Service, while an elevation-of-privilege bug impacts Azure OpenAI. Researchers credited with discovery include Nono and Anthropic's Benoît Sevens using Claude.
The Hacker NewsNov 11, 2026Translated from English