Microsoft released fixes for 1,259 vulnerabilities across its software lineup on Tuesday, marking the second month in a row that the company's patch count has topped 1,000 flaws. The November update addresses security weaknesses spanning Windows, Office, developer tools, and server products, with one Outlook flaw already being exploited by attackers in the wild.
The fixes break down to 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, and 27 in SharePoint Server, according to the security bulletin. The patches also contain 165 CVE identifiers issued by non-Microsoft parties. More than 500 of the vulnerabilities involve elevation of privilege issues, with remote code execution and information disclosure bugs making up the next largest categories. With this latest round, Microsoft has now resolved over 5,100 CVEs in 2026 alone, Satnam Narang, senior staff research engineer at Tenable, noted.
The actively exploited flaw affects Microsoft Outlook and carries the identifier CVE-2026-124194 with a CVSS score of 6.5, earning a Moderate severity rating from Microsoft. The company described the issue as one where "Product UI does not warn users of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network." An attacker without credentials could send a specially crafted message file and convince a target to open it, which would make Outlook connect to an attacker-controlled network location without showing the typical external-content warning. This could expose authentication information like an NTLMv2 hash that an attacker could then use to impersonate the victim. Microsoft credited a researcher named Nono and Anthropic's Benoît Sevens, who used Claude, with finding and reporting the vulnerability. The company stressed that exploitation requires both network access and user interaction, though it hasn't linked the activity to any specific threat actor or shared technical details about how attackers are leveraging the flaw in real-world attacks.
Jack Bicer, director of vulnerability research at Action1, explained the practical risk: "Email is the easiest door into any company, and this flaw turns one opened file into a stolen identity." A captured hash can allow an attacker to sign in as the victim, access their data, and pivot to other systems within reach, he said. The Moderate label "undersells this one," Bicer added, because attackers are already exploiting it, it requires just one click on an email file, and it targets Outlook, which nearly every organization runs. The U.S. Cybersecurity and Infrastructure Security Agency has added the vulnerability to its Known Exploited Vulnerabilities catalog, ordering federal agencies to apply the fix by November 24, 2026. The update also addresses notable remote code execution flaws in Windows Search, Lightweight Directory Access Protocol, Windows Schannel, Windows Virtual Filtering Platform, and Windows Xbox Live Networking Service, along with a privilege escalation issue in Azure OpenAI. Jake Knott, head of threat intelligence at watchTowr, advised that security teams should prioritize what's actually exposed to the internet, then what's being exploited in the wild, and only then everything else—especially after a month already packed with critical vulnerabilities and emergency patches. Organizations face mounting pressure to distinguish genuine threats from the daily drumbeat of security alerts, a challenge that only intensifies as vendors consolidate more products under single update cycles. The calculus for enterprise defenders has shifted from whether to patch to which patches can wait, forcing a triage mindset that relies as much on threat intelligence as on vendor severity scores.