Microsoft's 1,000-CVE Patch Tuesday Hides Exploited Outlook Bug

Microsoft closed out November's Patch Tuesday with fixes for 1,259 vulnerabilities across its portfolio — 1,094 of them Microsoft-issued CVEs plus 165 third-party identifiers — the second consecutive month the count has cleared a thousand, according to The Hacker News. Sixty-three are rated critical. October brought 1,474. If you run Windows, Office or Exchange — so, if you run an enterprise — this pile is yours to triage.

The flaw that matters most isn't the scariest on paper. CVE-2026-124194, an Outlook spoofing bug rated merely Moderate with a CVSS of 6.5, was already under active exploitation when the patch shipped. CISA has added it to the Known Exploited Vulnerabilities catalog with a November 24 remediation deadline for federal agencies. Affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 — effectively every Outlook install in enterprise land, per CSO Online. One opened message file, and a user's NTLMv2 hash is on its way to an attacker's server. If your triage queue is still sorted by CVSS score, this month is the counterexample that should finally break the habit.

One opened file, one stolen hash: how the Outlook bug works

Microsoft's advisory gives away the primitive in one bureaucratic sentence: the "Product UI does not warn users of unsafe actions in Microsoft Office Outlook." Outlook normally throws an external-content warning before a message makes the client reach out to a remote resource. This bug suppresses that prompt. The resulting chain, as Microsoft and The Register describe it, is short and brutal:

1. The attacker sends a specially crafted message file and persuades the target to open it in an affected Outlook build. User interaction is required — Microsoft confirms that — but a single click is the whole bar.
2. Outlook connects to an attacker-controlled network location without displaying the usual external-content warning.
3. Windows authenticates to that location with NTLM, disclosing the user's NTLMv2 hash.
4. The attacker either relays that hash to other systems to sign in as the victim, or cracks it offline to recover the password outright.

Microsoft doesn't specify the protocol of that "network location," but the NTLMv2 hash is the tell: that's the credential Windows volunteers when it authenticates to an SMB share or an NTLM-challenged HTTP endpoint. This is the classic forced-authentication primitive — the same family as every UNC-path and remote-template trick red teams have run for years — wearing a fresh Outlook skin. Here's roughly what the loot looks like when it lands in the attacker's cracking rig, in hashcat's Net-NTLMv2 format:

alice::CORP:5f3c1a9b7d2e4860:4f2b9d8c7a6e5f1a0b3c2d4e5f6a7b8c:0101000000000000...

Relay is the scarier of the two endgames because it skips cracking entirely: anywhere SMB or LDAP signing isn't enforced, that captured hash can authenticate as the victim in near-real time. Offline cracking, meanwhile, turns weak passwords into domain credentials on a GPU budget. Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative, put it plainly in his monthly review: "It's labeled spoofing, but the impact is bigger than the name suggests."

What's confirmed: the bug is exploited, it needs network connectivity plus one user click, and the patch exists. What's unknown: Microsoft hasn't attributed the attacks to any actor, said when exploitation started, described what attackers do with the access, or clarified whether the bug was found before or after it was first abused. Credit for the discovery goes to a researcher named Nono and to Anthropic's Benoît Sevens, working with the Claude AI assistant — more on that below.

"The Moderate label undersells this one. Attackers are already exploiting it, it needs only one click on an email file, and it hits Outlook, which nearly every organization runs. A stolen hash can open doors far beyond the inbox." — Jack Bicer, director of vulnerability research at Action1

Nightwing's cyber incident response manager Nick Carroll offered the shorter version to CSO Online: "Don't let the low score fool you." Until the patch lands, an effective email gateway and user awareness training can blunt delivery, since the attack needs a person to open a malicious Office file. That's a speed bump, not a wall.

The zero-click 9.8s aimed at Exchange and your domain controllers

Four flaws in the batch carry a CVSS of 9.8, and three of them need no credentials and no user action, Bicer noted. The two that should keep you up tonight:

• CVE-2026-119958 — Windows LDAP RCE. An unauthenticated attacker runs code inside the LDAP service. That's domain controllers, which means the whole Active Directory environment is in the blast radius.
• CVE-2026-116928 — Windows Search out-of-bounds write. Reachable through Exchange: send an email with a crafted attachment and Exchange's indexing processes it automatically. "The recipient does not need to open the email or attachment," Microsoft warned. Zero clicks, full remote code execution.
• CVE-2026-118207 — Exchange Server RCE. Triggerable by anyone able to send email to the organisation.
• CVE-2026-112967 — Xbox Live Networking Service RCE. Same-network attackers get full control of a Windows system. The name sounds like a gaming toy; the service is not.
• CVE-2026-119990 — Azure OpenAI elevation of privilege. A 9.8 in a cloud service many teams now depend on — but Microsoft patches this one automatically, so it's off your plate.

Also in the critical pile: remote code execution flaws in Windows Schannel (CVE-2026-119952) and the Windows Virtual Filtering Platform (CVE-2026-95962). Bicer's advice on sequencing is the most useful framing of the month: patch order should follow reach, not product names. Domain controllers and Exchange go first, then anything exposing IIS, Schannel or RPC to untrusted networks. Message Queuing deserves an inventory before it gets a patch — find every server where the service is enabled, turn it off where no application needs it, and patch the rest the same day. Hypervisor hosts get their own maintenance window, because one escape there is game over for everything on the box.

One non-Microsoft entry earns a mention: SAP fixed a CVSS 10 memory corruption flaw dubbed ICM2Shell, discovered by Onapsis, in the way the SAP kernel handles WebSocket traffic. A crafted sequence of WebSocket messages can crash the process or yield remote code execution, and it hits both SAP Internet Communications Manager and SAP Web Dispatcher — a reverse proxy many organisations park at the network edge. If SAP sits at your perimeter, that one joins the front of the queue too.

A 1,000-CVE month is the new normal, and AI is on both sides of it

The shape of the release tells the story of the era: 726 flaws in Windows, 174 in Office, 59 in SQL Server, 27 in SharePoint, plus developer tooling, with more than 500 elevation-of-privilege bugs leading RCE and information disclosure. Microsoft has now fixed over 5,100 CVEs this year alone, according to Satnam Narang, senior staff research engineer at Tenable. "Logging back-to-back months above 1,000 CVEs proves automated bug-hunting has permanently reset patch volume," Childs told The Register. "With AI making patch-diffing and exploit generation near-instant, the threat window opens the minute these updates drop."

The fatigue is real. "Maybe we should just go home," watchTowr's head of threat intelligence Jake Knott emailed The Register, after a month of bumper-to-bumper criticals and "'2shell'-branded everything" — a nod to emergencies like N-able's Able2Shell and the PHP2Shell pre-auth RCEs. His triage advice is the keeper: "Start with what you actually have exposed to the Internet, then what's already being exploited in the wild, and only then everything else."

There's a poetic wrinkle in the Outlook bug's discovery. Microsoft has been using an AI model to find thousands of vulnerabilities in its own products since the summer, per CSO Online — and the month's only exploited flaw was found by Anthropic's Sevens working with Claude. Narang's take: "For most of the year, AI has been building bigger haystacks across Patch Tuesday releases, and this appears to be the first time it has found a needle." None of the 1,094 Microsoft CVEs were publicly known before Tuesday, and only the Outlook bug is confirmed exploited — but Childs warns against "false comfort," because with public fixes out, reverse-engineering the patches into working exploits is now a near-instant, AI-assisted exercise.

Triage by reach, not by score

CVSS was built to measure technical severity — how bad a bug is in theory — not whether anyone is using it against you right now. A 6.5 Moderate that's leaking credentials in the wild outranks every theoretical 9.8 on an internal-only box, and a team of five cannot patch 1,094 things a month no matter how the queue is sorted. Think of CVSS like a monster's level in an RPG: it tells you how hard it hits, not whether it's already at your door. The economically sane order of operations this week:

1. Patch Outlook now — Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024. CVE-2026-124194 is exploited and on the KEV; treat CISA's November 24 federal deadline as your own.
2. Domain controllers and Exchange next — CVE-2026-119958 (LDAP) and CVE-2026-116928 (Windows Search via Exchange indexing) are unauthenticated, zero-click paths to your crown jewels.
3. Then anything exposing IIS, Schannel or RPC to untrusted networks — that's CVE-2026-119952 territory.
4. Inventory Message Queuing, disable it where nothing uses it, patch the rest the same day.
5. Give hypervisor hosts their own window — one escape there and every guest goes with it.

On the detection and hardening side, this month has a concrete to-do list beyond patching:

• Block outbound TCP 445 (and WebDAV) at the perimeter — no workstation has a legitimate reason to negotiate NTLM with an internet IP. Alert on any attempt; that alert is your tripwire for the next forced-authentication bug.
• Enforce SMB signing and LDAP signing, and prefer Kerberos where possible, so a relayed hash buys an attacker nothing.
• Hunt mail-gateway and endpoint telemetry for suspicious message-file attachments opened over the past month, especially anything that spawned an outbound connection from an Office process.
• If you run SAP at the edge, patch ICM2Shell on ICM and Web Dispatcher — a CVSS 10 with a reverse proxy in scope does not wait for next cycle.

Two months above a thousand CVEs isn't an anomaly; it's the baseline now, and AI is inflating it while simultaneously helping attackers diff patches faster than most change boards can convene. The shops that come out ahead won't be the ones with the biggest patching teams — they'll be the ones who stopped reading CVSS scores like tea leaves and started patching by exposure and exploitation. Start with Outlook. The hash you save is your own.