Microsoft’s November 2026 Patch Tuesday addresses 1,235 vulnerabilities, including an actively exploited Microsoft Outlook zero-day that can expose NTLM authentication information. The November release includes 66 critical vulnerabilities, comprising 48 remote code execution (RCE) flaws, 15 elevation of privilege (EoP) vulnerabilities, and three Microsoft Edge use-after-free vulnerabilities.
Although November’s release falls below October’s 1,411 reported vulnerabilities, it continues a period of unusually large security updates. Microsoft has attributed part of the increase in vulnerability disclosures to its use of AI-assisted vulnerability discovery, which has expanded the number of flaws identified across its software.
Approximately 639 vulnerabilities affect Windows or Windows-related components. Elevation of privilege remains the largest vulnerability category, accounting for 536 flaws, followed by 296 remote code execution vulnerabilities.
The most immediate concern is CVE-2026-124194, an Outlook spoofing vulnerability that attackers have already exploited to obtain NTLM authentication information. The flaw allows malicious message files to trigger outbound authentication attempts without Outlook displaying its usual external-content warning, potentially exposing credentials that could be used in subsequent attacks.
Breakdown of Vulnerabilities
- 536 Elevation of Privilege vulnerabilities
- 296 Remote Code Execution vulnerabilities
- 157 Information Disclosure vulnerabilities
- 46 Denial of Service vulnerabilities
- 27 Security Feature Bypass vulnerabilities
- 22 Spoofing vulnerabilities
- 142 Microsoft Edge (Chromium-based) vulnerabilities
These figures are approximate and reflect the classifications reported for November’s release. The six traditional vulnerability impact categories account for 1,084 entries. Microsoft Edge vulnerabilities are listed separately, and the combined figures do not account for every vulnerability in the 1,235 total.
The headline count excludes 108 vulnerabilities addressed earlier in November, including 82 Microsoft Mariner flaws, 25 Microsoft Edge vulnerabilities, and one Microsoft Entra Device Registration vulnerability.
Microsoft also released Windows 11 cumulative updates KB5132061 and KB5131087. Administrators should consult the applicable Windows release documentation to determine which update corresponds to their deployed operating system versions.
Zero-Day Vulnerabilities
November’s Patch Tuesday addresses one actively exploited zero-day vulnerability affecting Microsoft Outlook. The flaw is particularly relevant to enterprise environments where Outlook is widely deployed and NTLM authentication remains permitted.
CVE-2026-124194 | Microsoft Outlook Spoofing Vulnerability
CVE-2026-124194 is an actively exploited spoofing vulnerability that allows an unauthenticated attacker to expose NTLM authentication information through a specially crafted message file.
According to Microsoft’s advisory, an attacker can send a malicious message file and convince a user to open it in an affected Outlook installation. Opening the file can cause Outlook to connect to an attacker-controlled network location without displaying the external-content warning that would ordinarily alert the user.
The attack requires user interaction and network connectivity. It does not require the attacker to authenticate to Outlook before delivering the malicious file.
The underlying risk involves how Windows handles NTLM authentication when accessing network resources. If Outlook triggers a connection to an attacker-controlled server, Windows may attempt to authenticate using the current user’s credentials. This process can expose an NTLMv2 challenge-response to the remote server.
An attacker who captures this authentication exchange may attempt to recover the underlying password through offline guessing. Under suitable network and authentication conditions, captured NTLM authentication exchanges may also be useful in relay attacks.
Neither outcome is automatic. The feasibility of password recovery depends on factors such as password strength, and NTLM relay requires an appropriate target and authentication configuration.
This distinction matters for organizations investigating potential exploitation. The immediate exposure is authentication material, but the eventual impact depends on the credentials involved, the network environment, and the controls protecting downstream services.
The vulnerability also demonstrates why email security cannot be evaluated solely by whether an attachment contains executable malware. A malicious file may cause an application to initiate network activity that exposes authentication information without directly executing attacker-supplied code.
Organizations should prioritize the Outlook update, investigate suspicious outbound authentication attempts, and assess whether NTLM connections to untrusted destinations are permitted.
Other Critical Vulnerabilities
Beyond the Outlook zero-day, Microsoft addressed 66 critical vulnerabilities across the November release.
Remote code execution accounts for 48 critical flaws, making it the largest critical vulnerability category. These issues require evaluation against the affected products, attack prerequisites, and available mitigations rather than assuming every RCE vulnerability is remotely exploitable without authentication.
Another 15 critical vulnerabilities involve elevation of privilege. These flaws can become particularly significant after an attacker establishes an initial foothold, potentially allowing an account or process with limited permissions to obtain greater access.
Three critical Microsoft Edge vulnerabilities are described as use-after-free issues, a class of memory safety vulnerability involving access to memory after it has been released. Depending on the affected component and exploitation conditions, such flaws can lead to memory corruption and other security impacts.
Several individual vulnerabilities listed in the November release also warrant attention.
CVE-2026-118146 | Active Directory Domain Services Remote Code Execution Vulnerability
Microsoft lists CVE-2026-118146 as a critical remote code execution vulnerability affecting Active Directory Domain Services.
Given the role of domain controllers in enterprise authentication and authorization, administrators should review the advisory to establish affected versions, exploitation prerequisites, and required updates. The available reporting does not establish whether exploitation is unauthenticated.
CVE-2026-118148 | Active Directory Domain Services Elevation of Privilege Vulnerability
This critical vulnerability involves elevation of privilege in Active Directory Domain Services. Organizations should evaluate the flaw alongside other domain controller updates, with attention to the permissions required for exploitation and the potential impact on privileged directory operations.
CVE-2026-119969 | Graphic Fonts Remote Code Execution Vulnerability
Microsoft classifies CVE-2026-119969 as a critical remote code execution vulnerability affecting Graphic Fonts.
Font-processing vulnerabilities warrant attention due to the variety of applications and Windows components that handle formatted text and font data. Administrators should consult Microsoft’s advisory for the exact exploitation conditions and affected products.
CVE-2026-112967 | Windows Xbox Live Networking Service Remote Code Execution Vulnerability
This critical RCE vulnerability affects the Windows Xbox Live Networking Service. Organizations should determine whether the affected component is present on managed endpoints and apply the relevant updates where applicable.
The critical classification does not independently establish the network exposure or authentication requirements for exploitation.
Adobe and Other Vendor Updates
Several vendors also released security updates during November, including fixes for vulnerabilities already associated with active exploitation.
Barracuda Networks addressed two vulnerabilities that could allow attackers to execute commands with root privileges. Subsequent reporting confirmed that attackers had exploited the flaws, making affected email security appliances a priority for remediation and investigation.
Cisco released security updates across multiple products, including Catalyst SD-WAN Controller, Secure Email Gateway, and Meraki. Organizations should review the relevant advisories against deployed network infrastructure.
Google issued an emergency Chrome update addressing an actively exploited zero-day vulnerability. Administrators should verify browser patch status separately from the Windows cumulative update process.
Ivanti patched two Connect Secure vulnerabilities that attackers had chained in attacks dating back to October. Organizations operating affected appliances should review the relevant advisories and investigate potential compromise rather than treating patch installation alone as proof that the systems were not previously exploited.
N-able was responding to reports of more than 30 alleged zero-day vulnerabilities affecting N-central. The company took hosted environments offline and was preparing a hotfix. The reported vulnerabilities should be distinguished from independently confirmed exploitation until additional technical findings become available.
Linux distributions released security updates addressing an OpenSSH authentication bypass involving musl, commonly referred to as sshole. Affected systems require evaluation against the applicable distribution advisories and configuration prerequisites.
SAP released its November security updates, addressing four maximum-severity vulnerabilities across its software portfolio.
SonicWall patched seven vulnerabilities in SonicOS, including an SSL-VPN multifactor authentication bypass that had been exploited in attacks. Organizations operating affected firewalls should prioritize the update and review remote-access authentication activity for signs of suspicious access.
Vates addressed an actively exploited authentication bypass vulnerability in Xen Orchestra. The vulnerability is particularly relevant to environments using the platform to administer virtual machines and associated infrastructure.
Zyxel released a fix for an exploited zero-day affecting GS1900 series network switches. Reporting linked the vulnerability to attacks compromising nearly 1,000 devices worldwide.
Recommendations for Users and Administrators
Organizations should prioritize CVE-2026-124194 due to confirmed exploitation and its potential to expose authentication information through Microsoft Outlook. Administrators should identify affected Outlook installations, deploy the applicable security updates, and verify successful installation.
Security teams should also examine the conditions that make NTLM credential disclosure possible. Restricting unnecessary outbound SMB traffic, reducing NTLM dependencies, and limiting authentication to untrusted network destinations can reduce exposure to attacks involving malicious documents and message files.
Detection efforts should focus on unexpected outbound authentication activity originating from user workstations, particularly connections initiated after suspicious email attachments or message files are opened. Where sufficient telemetry is available, analysts can correlate Outlook activity, network connections, and authentication events to identify potentially malicious behavior.
Organizations should review the 48 critical RCE vulnerabilities and 15 critical elevation of privilege vulnerabilities according to affected products and actual deployment conditions. Domain controllers, privileged workstations, internet-facing infrastructure, and systems processing untrusted content deserve particular attention.
Third-party updates should also be included in remediation planning. Actively exploited vulnerabilities affecting Ivanti Connect Secure, SonicWall, Barracuda appliances, and Xen Orchestra may expose systems responsible for remote access, email security, and virtualization management.
For systems with evidence of prior exploitation, administrators should follow incident response procedures rather than relying exclusively on software updates. Patching addresses the vulnerability but does not necessarily eliminate persistence mechanisms, compromised credentials, or other changes made during an intrusion.
With more than a thousand vulnerabilities addressed in November, effective remediation depends on identifying applicable updates, prioritizing confirmed exploitation, and verifying that patches reach affected systems. Organizations should use Microsoft’s Security Update Guide and the relevant vendor advisories to confirm remediation requirements and monitor for new exploitation information.
How Can Netizen Help?
Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally.
Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.
Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.
Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.
Leave a Reply