Microsoft's November Patch Tuesday addresses 1,094 vulnerabilities, among them an Outlook spoofing flaw that attackers have already exploited and two critical zero-click bugs in Windows Search and LDAP. The Outlook issue, CVE-2026-124194, is the only vulnerability under active exploitation.
Jake Knott, head of threat intelligence at exposure management firm watchTowr, said most security teams have not quite recovered from last month's run of critical vulnerabilities, emergency patches and '2shell'-branded everything. "Maybe we should just go home," he said.
Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative, cautioned that the Outlook flaw should not be deprioritised because of its 6.5 CVSS score. "It's labeled spoofing, but the impact is bigger than the name suggests," he said. Childs wrote: "An attacker sends a specially crafted message file and convinces a user to open it." "Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user's NTLMv2 hash." "The attacker can use that hash to authenticate as the user." Microsoft marked the bug as exploited but has not said when the attacks began or who is behind them.
November's release is the second consecutive Patch Tuesday to exceed 1,000 fixes, after October's 1,474. Childs said the numbers should not give organisations "false comfort": "Logging back-to-back months above 1,000 CVEs proves automated bug-hunting has permanently reset patch volume. With AI making patch-diffing and exploit generation near-instant, the threat window opens the minute these updates drop."
Two zero-click flaws, both rated 9.8, need no user interaction. CVE-2026-116928 is an out-of-bounds write in Windows Search that can be triggered by sending an email with a specially crafted attachment to Exchange, which automatically processes the attachment for indexing, so the recipient does not need to open the email or attachment. Successful exploitation could let an attacker execute code with the permissions of the affected processing service. CVE-2026-119958 is an out-of-bounds write in Windows' LDAP implementation that can be exploited by sending specially crafted LDAP requests, potentially compromising domain controllers.
Childs also counts 30 CVEs posing a "wormable risk," needing zero authentication and zero user interaction over a network. A further critical flaw, CVE-2026-112967 in the Windows Xbox Live Networking Service, is a heap-overflow rated 9.8 that requires no authentication or user interaction and could allow remote code execution.
Defenders should abandon broad triage and act immediately, Childs said: patch Exchange and Domain Controllers (LDAP/Kerberos) first to stop zero-click compromise, ring-fence exposed network services such as DNS and DHCP to prevent wormable spread, and verify manual administrative fixes on cloud services.
Analysis
Why This Matters
- The Outlook zero-day exposes NTLMv2 hashes, which can be used to authenticate as the affected user, and it has already been exploited before a patch existed.
- Two rated-9.8 zero-click flaws can be triggered without any user interaction, including via email attachments processed automatically by Exchange and crafted LDAP requests that can compromise domain controllers.
- The second consecutive month above 1,000 CVEs points to a permanent reset in patch volume, with AI speeding up patch-diffing and exploit generation, and 30 further flaws pose a wormable risk.
Background
Patch Tuesday is Microsoft's monthly scheduled release of security updates across its product line. November's release follows an unusually large October update of 1,474 fixes, and experts quoted in the report say automated bug-hunting has permanently reset the volume of patches organisations must handle.
Key Perspectives
Jake Knott (watchTowr): says security teams have not recovered from last month's critical vulnerabilities and emergency patches, adding, "Maybe we should just go home."
Dustin Childs (TrendAI's Zero Day Initiative): says the Outlook bug's impact is bigger than its spoofing label suggests and warns against taking "false comfort" from the scale of fixes, because the threat window opens the minute updates drop.
Microsoft: warns that Exchange automatically processes specially crafted attachments for indexing, so recipients do not need to open an email or attachment for the Windows Search flaw to be exploited.
What to Watch
- Whether Microsoft or researchers disclose who is exploiting CVE-2026-124194 and what the access is used for.
- Whether organisations follow Childs' advice to patch Exchange and domain controllers first, ring-fence DNS and DHCP, and verify cloud administrative fixes.
- Whether the next Patch Tuesday again tops 1,000 CVEs, which would confirm the reset in patch volume and faster exploit development.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedMicrosoft's November release fixes 1,094 flaws, including an Outlook flaw attackers had exploited before the patch was released.www.theregister.com - Articles: “Microsoft fixing 1,094 bugs in its products, including one that attackers exploited before Redmond released a patch.”
- SupportedThe release includes two critical zero-click vulnerabilities rated 9.8: one in Windows Search and one in LDAP.www.theregister.com - Articles: “There are two zero-click threats in this month’s batch of fixes: CVE-2026-116928 and CVE-2026-119958. Both are critical, carrying 9.8 CVSS ratings, in part because they don’t require any user interaction to exploit.”
- SupportedThe Outlook flaw, CVE-2026-124194, is the only vulnerability under active exploitation.www.theregister.com - Articles: “CVE-2026-124194 is the only one under active exploitation, and none of the 1,094 are listed as publicly known.”
- SupportedJake Knott said, “Maybe we should just go home.”www.theregister.com - Articles: “Jake Knott, head of threat intelligence at exposure management firm watchTowr, succinctly said in an email to The Register: “Maybe we should just go home.””
- SupportedDustin Childs said, “It's labeled spoofing, but the impact is bigger than the name suggests.”www.theregister.com - Articles: ““It’s labeled spoofing, but the impact is bigger than the name suggests,” Childs said in his monthly Patch Tuesday review.”
- SupportedChilds's quoted description says an attacker can persuade a user to open a crafted message file, causing Outlook to connect to an attacker-controlled network location, disclose the user's NTLMv2 hash, and let the attacker authenticate as the user.www.theregister.com - Articles: ““An attacker sends a specially crafted message file and convinces a user to open it,” he wrote. “Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user’s NTLMv2 hash. The attacker can use that hash to authenticate as the user.””
- SupportedMicrosoft marked the Outlook flaw as exploited but did not say when attacks began or who was behind them.www.theregister.com - Articles: “Microsoft marked CVE-2026-124194 as exploited, but per usual didn’t say when the attacks started, who is battering this bug, and what they are doing with the access post exploitation.”
- SupportedNovember is the second consecutive Patch Tuesday with more than 1,000 fixes, following October's 1,474.www.theregister.com - Articles: “Despite the second month of more than 1,000 CVEs (October had 1,474)”
- SupportedChilds said the back-to-back months above 1,000 CVEs show automated bug-hunting has reset patch volume, and that AI makes the threat window open as soon as updates drop.www.theregister.com - Articles: ““Logging back-to-back months above 1,000 CVEs proves automated bug-hunting has permanently reset patch volume,” he told The Register. “With AI making patch-diffing and exploit generation near-instant, the threat window opens the minute these updates drop.””
- SupportedChilds counts 30 CVEs posing a wormable risk that require zero authentication and zero user interaction over a network.www.theregister.com - Articles: “Childs also counts 30 CVEs that pose a “wormable risk,” requiring zero authentication and zero user interaction over a network.”
- SupportedThe Windows Search flaw can be triggered by emailing Exchange a specially crafted attachment; the recipient need not open it, and successful exploitation could allow code execution with the processing service's permissions.www.theregister.com - Articles: “Exchange automatically processes the attachment for indexing, so the recipient does not need to open the email or attachment. Successful exploitation could allow the attacker to execute code with the permissions of the affected processing service.”
- SupportedThe Xbox Live Networking Service flaw, CVE-2026-112967, is a heap-overflow rated 9.8 that requires no authentication or user interaction and could allow remote code execution.www.theregister.com - Articles: “It's a heap-overflow vulnerability with a 9.8 CVSS rating that doesn't require authentication or user interaction to exploit.”
