Key takeaways
- Microsoft's November 2026 release fixes 1,094 vulnerabilities — Windows alone accounts for 726, Office 174, SQL Server 59 and SharePoint 27 (SecurityWeek).
- One bug is already being exploited: CVE-2026-124194 in Outlook. Opening a crafted message file makes Outlook connect to an attacker's server without the usual warning and leak the user's NTLMv2 hash. It is rated only 6.5 (CVSS), but stolen hashes are how attackers move from one mailbox to the whole domain.
- The Outlook fix ships through Office updates, not the Windows cumulative update. If you only push Windows patches through WSUS or Intune, you are not covered.
- Three 9.8-rated, no-click remote code execution bugs deserve this week's attention: Windows LDAP on domain controllers (CVE-2026-119958), Windows Search reachable through Exchange (CVE-2026-116928), and the Xbox Live Networking Service (CVE-2026-112967) (The Register, SOCRadar).
- Monthly patch volume has permanently changed. October was over 1,400 CVEs; November is 1,094. Testing every patch by hand no longer works — you need a ring-based rollout and a short "patch first" list each month.
1. What happened on 10 November
Microsoft's monthly security release landed on Tuesday, 10 November 2026 (around 11:30 pm IST). The headline count — 1,094 CVEs — is agreed by SecurityWeek, The Register and SOCRadar. Some outlets quote slightly different totals depending on whether they count third-party CVEs that Microsoft republishes (SecurityWeek notes 165 of those this month), so do not worry if your dashboard shows a different number.
SOCRadar counts 63 Critical-rated issues and estimates about 30 are "wormable" — able to spread between machines without anyone clicking anything. Zero Day Initiative's Dustin Childs, quoted by The Register, puts the jump in volume down to automated, AI-driven bug hunting, which also makes it much faster for attackers to reverse-engineer a patch into an exploit. SecurityWeek says Microsoft has fixed more than 5,000 vulnerabilities so far in 2026.
By impact type, SOCRadar's split is roughly 49% privilege escalation, 27% remote code execution, 14% information disclosure and 10% everything else.
2. The exploited Outlook bug, in plain words
CVE-2026-124194 is classed as a spoofing flaw. The chain, as all three sources describe it:
- The victim opens a specially crafted message file in Outlook.
- Outlook reaches out to a network location the attacker controls — and skips the "external content" warning it should show.
- Windows sends the user's NTLMv2 authentication hash along with that connection.
- The attacker relays or cracks that hash and logs in elsewhere as the user.
Microsoft says the Preview Pane is not an attack path — the file has to be opened. It has not said who is exploiting it or against whom. The bug was credited to a researcher using the handle "nono" and to Benoit Sevens; SecurityWeek and SOCRadar both report that the acknowledgement mentions Anthropic's Claude model being used in the research.
Affected: Microsoft 365 Apps for Enterprise and Office LTSC 2024, with SecurityWeek also listing Office LTSC 2021. SOCRadar reports that CISA added it to its Known Exploited Vulnerabilities list with a 24 November deadline for US federal agencies — a useful benchmark even if you are not bound by it.
Why a "moderate" score is misleading: in a typical Indian SMB or mid-size company, many staff are local admins, NTLM is still enabled everywhere, and SMB signing is often off. One leaked hash from an accounts or HR user can be enough to reach file shares and, from there, the domain controller.
3. Patch order for this week
| Priority | What | CVE | Severity | Why first | Patch channel |
|---|---|---|---|---|---|
| 1 | Outlook (M365 Apps, Office LTSC 2021/2024) | CVE-2026-124194 | 6.5, exploited | Under active attack; leaks credentials | Office / Click-to-Run update |
| 2 | Domain controllers — Windows LDAP | CVE-2026-119958 | 9.8 | Unauthenticated, network, no user action | Windows cumulative update |
| 3 | Exchange servers — Windows Search | CVE-2026-116928 | 9.8 | Reachable through Exchange, no click | Windows CU on the Exchange host |
| 4 | Exchange Server itself | CVE-2026-118207 | 8.8 | Remote code execution on mail server | Exchange SU |
| 5 | Other Windows servers and PCs | Kerberos, DNS, DHCP, Schannel, Message Queuing fixes | 8.1–9.8 | Many wormable; "exploitation more likely" on Schannel | Windows CU |
| 6 | SQL Server, SharePoint, Hyper-V hosts | e.g. CVE-2026-116945, CVE-2026-120002 | up to 9.9 | High impact, but usually internal-facing | Product updates |
Severity figures are from SOCRadar's breakdown unless stated otherwise. For the Xbox Live Networking Service bug (CVE-2026-112967, 9.8), most business desktops will be covered by the normal Windows cumulative update — just make sure it actually installs.
4. Mitigations while you test
Patching Office across a few hundred laptops can take a week. Until then, these reduce the risk of the NTLM-leak class of bugs. They are general hardening steps, not an official Microsoft workaround:
- Block outbound SMB (TCP 445) at the firewall to the internet. Almost no business needs it, and it stops most hash-leak attacks cold.
- Turn on SMB signing and LDAP signing/channel binding on servers and domain controllers.
- Put administrators and finance users in the Protected Users group, which stops NTLM use for those accounts.
- Warn staff about unexpected attachments with .msg or .eml files, especially "invoice" and "GST notice" lures, which are common in Indian phishing.
- Audit NTLM usage with Group Policy auditing first, then start restricting it. Microsoft has been moving away from NTLM for years; each month like this is another reason to finish the job.
5. The India angle
Reporting rules. Under CERT-In's April 2022 directions, Indian organisations must report certain cyber incidents — including unauthorised access to systems — within six hours of noticing them. If you find signs that Outlook hashes were leaked and reused, that clock may already apply. Separately, the Digital Personal Data Protection Act, 2023 requires breach notification where personal data is affected.
Licensing reality. Many Indian firms run Office 2016/2019 perpetual licences or older Exchange builds bought years ago. Those versions are not in Microsoft's affected list for the Outlook bug — but that is because they are out of support and no longer receive fixes at all, not because they are safe. If you are still on them, the budget conversation for Microsoft 365 or Office LTSC 2024 is overdue.
Domain controllers on old hardware. An unauthenticated 9.8 LDAP flaw on a domain controller is the worst-case scenario for a small IT team. If your DC is still on Windows Server 2012 R2 without Extended Security Updates, it gets no patch — read our Windows Server 2012 ESU guide and plan the upgrade now.
Lifecycle notes this month. Windows 11 version 23H2 Enterprise and Education receive their final monthly security update this month (KB5131087), per SecurityWeek and SOCRadar. SOCRadar also reports that .NET 8, .NET 9 and PowerShell 7.4 have reached end of support — check your app servers.
6. A patch routine that survives 1,000-CVE months
| Approach | Time to patch | Risk of breaking something | Fits |
|---|---|---|---|
| Patch everything on day 1 | 1–2 days | High | Very small offices (under 20 PCs) |
| Ring rollout: IT pilot → 10% → all | 5–10 days | Low | Most SMBs and mid-size firms |
| Wait for "month-end" window | 3–4 weeks | Low, but long exposure | Not recommended any more |
| Exploited / 9.8 fast-track + ring for the rest | 2–3 days for top items | Moderate | Recommended default |
The practical routine: on Patch Tuesday night, pull the exploited and Critical-network list (it is usually under ten items). Push those to a pilot ring on Wednesday and everyone by Friday. Let the remaining hundreds of fixes flow through your normal ring over the next week. Track Office separately — this month shows it lives in a different update channel.
Bottom line
The single exploited bug this month is an Outlook credential leak, and its fix is in Office updates, not Windows ones. Patch Outlook first, then domain controllers and Exchange hosts, block outbound SMB today, and use this month to set up a fast-track lane for exploited and 9.8-rated bugs, because 1,000-CVE months are now normal.
Need help keeping Windows, Office and Exchange patched across your offices without breaking business apps? Our managed IT services team runs ring-based patching and NTLM hardening for Indian SMBs, and our incident monitoring service watches for credential misuse after the fact.