Microsoft’s November 2026 security release spans more than a thousand vulnerability records. The headline number is hard to act on: an organization does not have every affected product, and not every flaw has the same attack path. One Outlook flaw is already being exploited. Other serious issues affect services such as Windows Search and LDAP, where exposure depends on the systems an organization runs and who can reach them.

TL;DR

  • CVE-2026-124194 in Outlook is the one flaw Microsoft marks as actively exploited in this release. It can expose NTLMv2 authentication data when a user opens a crafted message file.
  • Prioritize reachable Windows Search, LDAP, and other server services according to the products and network paths in your environment.
  • Check the installed Office build for the Outlook fix and the installed Windows update for affected servers. A deployment job marked complete is not proof that the right update is running.
  • The reported total of 1,259 includes republished third-party vulnerabilities. It is not a list of 1,259 newly discovered Microsoft flaws.

What the 1,259 figure tells you

The Hacker News reports 1,259 entries, including 165 vulnerabilities assigned outside Microsoft and republished in its update material. That leaves 1,094 Microsoft-assigned entries by that count. Other analyses use different totals because they include or exclude different republished and previously addressed records. The Zero Day Initiative’s review describes roughly 1,090 new CVEs.

The count shows the scale of the release, but the useful unit for patching is an affected product on a specific system. First identify the software and roles you operate. Then match the relevant Microsoft advisories to the updates actually installed there.

Outlook: the confirmed exploitation

Microsoft rates CVE-2026-124194 Moderate, with a CVSS score of 6.5, but marks it as exploited. The score describes potential technical impact; the exploitation flag says attacks have been detected. Microsoft’s advisory does not identify the attackers, victims, or scale of the activity.

Microsoft lists Microsoft 365 Apps for Enterprise, Office LTSC 2024, and Office LTSC 2021 among the affected products. Teams should check the product and update table in the advisory before deciding whether a particular installation is vulnerable. Outlook products do not all use the same update path.

According to Microsoft, an attacker can send a specially crafted message file to a user. Opening it in a vulnerable Outlook client may cause the client to connect to an attacker-controlled location without the usual warning about external content. That connection can disclose the user’s NTLMv2 authentication data. This is not the user’s plaintext password, but Microsoft says the attacker could use the data to authenticate as that user.

This requires the user to open the crafted file; simply receiving an email is not the described trigger. Microsoft also says the Preview Pane is not an attack vector, so disabling it is not a fix for this CVE. The public advisory does not provide a reliable file pattern or network indicator that identifies a specific attack. Avoid treating every unusual Outlook connection as confirmed exploitation.

Other fixes worth checking early

These issues have different prerequisites. Their place in a patch queue depends on whether the affected service is present and reachable. Microsoft has not marked the issues listed below as exploited in its November advisories.

IssueWhy it mattersFirst check
CVE-2026-116928, Windows SearchZero Day Initiative reports that a crafted email attachment can be indexed automatically on an Exchange server and trigger remote code execution without the recipient opening it.Identify Exchange servers and the applicable Windows Search update. Verify the server’s installed Windows build after deployment.
CVE-2026-119958, Windows LDAPMicrosoft describes unauthenticated remote code execution through crafted LDAP requests. A reachable domain controller or other affected LDAP service would be a high-value target.Identify affected Windows servers that handle LDAP and confirm their November update status and network reachability.
CVE-2026-110043 and CVE-2026-110068, OutlookCrowdStrike’s release analysis highlights Office flaws for which previewing content can be an attack path. These are separate from the exploited NTLMv2 issue above.Check the affected Outlook versions and update guidance in each advisory; do not apply one CVE’s trigger conditions to another.

The wider release also includes many local privilege-escalation flaws. They matter when an attacker has already reached a device and wants more control, so endpoint updates still belong in the plan. Zero Day Initiative calls out Hyper-V and several Windows components in that group. Review the roles you actually run before assigning urgency from a CVSS score alone.

What You Can Do Today

  1. Sort the inventory by product and role. Identify Outlook clients, Exchange servers, domain controllers, and other Windows servers running affected services. Record each device’s installed version or build, update channel where relevant, owner, and network reachability. This turns a four-digit CVE count into a list of systems that need work.
  2. Patch Outlook and check the Office build. For Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024, follow CVE-2026-124194’s update table. In an Office app, File → Account shows version information. For Microsoft 365 Apps, compare the installed channel and build with Microsoft’s November 10 release history. A Windows update alone does not establish that Office was fixed.
  3. Check reachable servers next. Map Windows Search, LDAP, and other relevant services to their individual advisories. Apply the appropriate Windows and product updates, then verify the installed build on each server. If a service cannot be updated promptly, review who can reach it and restrict unnecessary access while the patch is scheduled. Test any change against legitimate traffic.
  4. Review possible Outlook exposure. If a user opened an unexpected message file on an unpatched device, preserve the file and relevant endpoint and network logs. Look for authentication attempts to unusual external destinations around the time it was opened, then assess subsequent account activity. An outbound connection is an investigative lead, not proof of this specific exploit.
  5. Check the egress boundary. Microsoft’s SMB security guidance recommends blocking outbound TCP 445 to the internet at the corporate firewall. Check whether remote devices follow the same policy. This reduces one route for credential exposure; the Office update is still required. If you plan broader NTLM restrictions, audit legitimate use first because denying NTLM can break applications.

Sources