Microsoft's November Patch Tuesday landed on 10 November with fixes for more than 1,200 security flaws across Windows, Office, Edge, and Defender — one of the largest updates of the year, and the second month running to top 1,000. Buried in that pile is one flaw attackers are already using: CVE-2026-124194, a spoofing bug in Outlook.
The flaw lets an attacker send a specially crafted message that, when opened in Outlook, quietly connects to a server the attacker controls — without showing the warning Outlook normally gives before trusting external content. That connection can be used to capture the victim's NTLMv2 authentication hash, which an attacker can then try to crack offline or relay to impersonate that person elsewhere on the network. Microsoft rates the bug only "Moderate" (CVSS 6.5), but the US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog the same day, confirming active exploitation and setting 24 November as the deadline for US federal agencies to patch.
The same update also closes several Critical-rated remote-code-execution holes in Excel, Microsoft Defender, and Edge — flaws that could let an attacker run their own code just by getting someone to open a crafted file or webpage. None of those are confirmed exploited yet, but with the fix now public, researchers expect that to change quickly.
What this means for your business
If your team uses Outlook — and almost every business does — this update isn't homework for later. The Outlook flaw is already being used against real targets, and it only takes one crafted email reaching one inbox. Hash theft from a single machine is often just the first step: an attacker who cracks or relays that hash can use it to reach whatever else that person's account touches.
This week, confirm that November's update has actually installed on every work laptop and desktop, not just your servers — desktops running Outlook are often the ones that lag, especially if they were off or on a slow connection on patch day. If an outsourced IT provider manages your systems, ask them to confirm it directly rather than assuming it happened automatically. If anyone on your team recalls an odd Outlook prompt or a message that looked right but felt slightly off recently, it's worth a quick look at that account's sign-in activity.
More broadly, a 1,200-flaw month is a reminder that "set to auto-update" isn't quite the same as "confirmed patched" — someone still needs to check, especially for anything handling email.