November 2026 Patch Tuesday: 1,235 fixes and the Outlook hash thief

THREAT ADVISORY · 1MC-LABS TEAM · NOVEMBER 11, 2026

The second largest Patch Tuesday in history, one month after the largest. One zero-day being exploited right now, rated Moderate, that steals NTLM hashes through an email. Sixty-six Critical bugs, two of them on your domain controllers. Here is what to patch first, what we are hunting for, and the detection pack to go with it.

Two records in a row

Microsoft shipped fixes for 1,235 vulnerabilities today. Last month was 1,411 and everyone called it a record. This month is smaller on paper and it is still the second largest Patch Tuesday ever.

Set Edge aside, where 142 Chromium bugs got folded into the count, and the Microsoft-authored total is 1,093, which is almost exactly where October landed without its own Edge tally. Nothing got better. The curve just stopped going vertical for one month.

Sixty-six of today’s fixes are rated Critical. Forty-eight of those are remote code execution, fifteen are privilege escalation, three are Edge use-after-frees. By category you get 536 privilege escalation bugs, 296 remote code execution bugs, 157 information disclosure bugs, 46 denial of service bugs, 27 security feature bypasses, and 22 spoofing flaws. Add the 108 fixed earlier in the month across Mariner, Edge, and Entra Device Registration and the real November number is 1,343.

One zero-day this month, and it is being used in attacks right now. It is in Outlook, it steals NTLM hashes, and Microsoft rated it Moderate. We will get to why that rating is the least useful fact about it.

Same rule as last month. The number is not the story. Less than one percent of what Microsoft patches ever lands on the CISA Known Exploited Vulnerabilities list, and nobody has the staff to triage 1,235 CVEs one at a time. What you need is the short list of bugs your attacker can actually reach, a reboot window for the boxes that matter, and somebody watching the hosts you could not patch yet. That is the rest of this advisory.

The emergency board

If you read nothing else, read this board. It is ordered the way we would work it, top to bottom. Status is what Microsoft published as of November 10. Only one bug on this list is confirmed exploited. The rest earn their spot because nobody has to log in, nobody has to click, or the box they live on is the one that runs your network. Microsoft did not publish CVSS scores in the summary this month, so the pill shows Microsoft’s own severity rating.

When CISA adds any of these to the Known Exploited Vulnerabilities catalog, the clock changes from this week to today. We will update this advisory as that happens.

The curve did not break, it took a breath

Twelve months ago Patch Tuesday was 57 bugs. A big month was anything over 100. Then the curve bent. April hit 167, June 200, July 570, September 966, October 1,411. November came in at 1,235 and some people will read that as relief. It is not. It is the second largest Patch Tuesday in history, and it beats every month before October by at least 270 bugs. September, October, and November together are 3,612 fixes. The nine months before them add up to 1,765. We are now patching more in a quarter than we used to patch in two years.

August dipped after July too, and then September doubled. One down month is noise. The slope is the signal, and the slope is AI pointed at Microsoft’s own code, on both sides of the fence. The bugs were always there. What changed is the time between a bug existing and somebody noticing it. If your patch process was built for 60 CVEs a month, it is a process for a world that no longer exists, and this month did nothing to bring that world back.

The zero-day: Moderate on paper, a domain compromise in practice

CVE-2026-124194, Microsoft Outlook, exploited in the wild. Microsoft calls it a spoofing vulnerability and rates it Moderate. Here is what it actually does. An attacker sends a crafted message file. The user opens it in Outlook. Outlook reaches out to a network location the attacker controls, and it does so without showing the external content warning that normally stands between you and that connection. Windows, being helpful, tries to authenticate to that location. The attacker captures the NTLMv2 hash and takes it home to crack offline, or relays it live to a service that still accepts NTLM.

That is not spoofing in any sense a defender cares about. That is credential theft with one click, and the click is on an email, which is the one thing every user in your company does a hundred times a day. Microsoft says exploitation requires network connectivity and user interaction. Both of those are true of reading mail.

We have seen this exact movie. CVE-2023-23397 was an Outlook NTLM leak that needed zero clicks and became a state actor favorite for a year. CVE-2026-32202 in April was a Windows Shell NTLM leak that Microsoft had to patch twice. The pattern is old because it works. The hash is the prize, and once an attacker has a hash they do not need a vulnerability anymore. They have a user.

Patch it today on every Outlook install, and then do the thing the patch does not do for you: go find out where NTLM is still accepted in your environment. If you can relay a hash to Exchange, to a file server, to LDAP on a domain controller without signing, this bug was never the real problem. It was just the delivery truck.

Two notes. First, the affected list includes Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, so this is not a legacy-only issue. Second, Microsoft published nothing about who is using it or how, and neither has anyone else, so we are not going to guess for them.

No other zero-days this month, and no publicly disclosed flaws. For once the headline count and the real emergency are the same number: one.

Patch these first

We sort by how an attacker reaches the bug, not by the severity label. A Critical that needs a logged-in admin is a smaller problem than a Moderate that fires when someone opens an email. This month proves the point.

Tier 1: today, before you go home

• CVE-2026-124194, Outlook NTLM disclosure. The exploited zero-day. Every endpoint with Outlook on it.
• The twenty Outlook remote code execution bugs. Three Critical (CVE-2026-110043, 111309, 110068) and seventeen Important. Last month it was five. Outlook is the most attacked application on your network because it is the one that opens untrusted content all day by design. Same patch window as the zero-day.
• CVE-2026-118146 and 118148, Active Directory Domain Services. A Critical RCE and a Critical privilege escalation on the domain controller. Second month in a row with a Critical RCE on the DC. An RCE on a DC is a full-domain compromise, and we do not care what the label says.
• CVE-2026-119958, Windows LDAP. Critical RCE in the directory protocol itself, which means the DC listening on 389 and 636 for every client in the building. Stack it with the AD DS fixes in the same reboot.
• CVE-2026-119962, CredSSP. Critical RCE in the protocol that carries your credentials for RDP and WinRM. If you manage servers remotely, you use CredSSP whether you know it or not.
• CVE-2026-118207, Exchange Server. Critical RCE plus eight Important Exchange bugs in the same release, including two more RCEs. If you still run on-prem or hybrid Exchange, this goes in the same window as Outlook.

Tier 2: this week, anything with a network stack

• CVE-2026-113825, SMB Server (srvnet.sys). Critical RCE in the kernel-mode SMB transport. The last unauthenticated kernel SMB bug of consequence was EternalBlue. Microsoft has not said this one is wormable, and we are not saying it either, but we are not waiting to find out.
• CVE-2026-113859, Windows TCP/IP. Critical RCE in the stack every Windows host runs. No service has to be installed for this one to be reachable.
• CVE-2026-119952, Schannel. Critical RCE in Windows TLS. Anything that terminates TLS on Windows, which is IIS, RD Gateway, LDAPS, and half your line-of-business apps.
• CVE-2026-118737, RPC Runtime. Critical RCE on port 135, which is open on every Windows box on your LAN and reachable from any foothold.
• Message Queuing, five Critical RCEs: CVE-2026-119963, 116710, 119964, 109459, 119967. MSMQ is off by default. We have said that three months running and we keep finding it on.
• CVE-2026-119961, IIS. Critical RCE in the web server. If it faces the internet, it is Tier 1.
• CVE-2026-119957, Remote Desktop Services. Critical privilege escalation. Exposed RDP plus a Critical EoP is how ransomware operators start their week.
• CVE-2026-113752, Print Spooler. Critical RCE. PrintNightmare never really ended, it just stopped making headlines.
• CVE-2026-113862, NAT; CVE-2026-125134 and 118145, Function Discovery and SSDP; CVE-2026-125136, Network Connected Devices Auto-Setup; CVE-2026-119951, Windows Deployment Services; CVE-2026-112967, Xbox Live Networking. Critical RCEs in services you forgot were running. Function Discovery and SSDP are on by default on workstations. Audit what is listening, because this list is what an attacker on your LAN is going to try.
• CVE-2026-116928, Windows Search. Critical RCE. Search indexes everything a user touches, including the attachments they did not open.
• CVE-2026-122194, Microsoft Defender. Critical RCE in the Malware Protection Engine, which scans every file on the box. The fix ships through the engine update, not Patch Tuesday, so it is probably already applied. Verify the engine version anyway, because an RCE in the scanner is an RCE that fires on files nobody opened.

Tier 3: this week, anything a human opens a file on

• Office: CVE-2026-120003 and 111289 (Office), 110047, 110067, 111285, 124185 (Word), 120005 (PowerPoint), and twelve Critical Excel RCEs. Office documents and mail clients again account for a Patch Tuesday from last year all by themselves.
• CVE-2026-119969, Graphic Fonts; CVE-2026-113749, Windows Codecs; CVE-2026-114169, Raw Image Extension; CVE-2026-96067, 96054, 96078, Color Management. Parsers. A font in a web page, an image in an email, a color profile in a document. The user never has to do anything except look.
• CVE-2026-112985 and 105578, JScript. Important RCEs, but JScript is what runs when someone double-clicks a .js attachment, and that is still a top five initial access technique.

Tier 4: before the end of the month, the ladder bugs

Five hundred thirty six privilege escalation bugs. The ones that matter are the Critical ones and the ones an attacker chains after a phishing landing to get SYSTEM: Graphics Kernel CVE-2026-125137 and 119966, the eight Critical Hyper-V escalations (CVE-2026-113861, 119960, 113753, 113860, 113856, 113864, 119947, 113865), TPM CVE-2026-119382, and the pile of Desktop Window Manager, Kernel Transaction Manager, and HID Parser escalations. The Hyper-V set deserves a second look if you run multi-tenant hosts, because a guest-to-host escalation is not a privilege escalation, it is a breach of everyone on the box.

SQL Server: 60 bugs, zero Critical, and that is the wrong way to read it

Fifty-plus SQL Server fixes this month, including at least twenty remote code execution bugs rated Important. Important means an attacker needs a login. In a SQL environment that is often the application service account with a password in a config file, so treat the SQL RCEs as Tier 2 on any instance that is reachable from a workstation subnet.

Cloud: nothing to deploy, something to check

Microsoft already fixed Azure OpenAI (CVE-2026-119990), Azure Managed Grafana (CVE-2026-114160), and Entra Device Registration (CVE-2026-109469) on their side. The Entra one is the one we care about. A privilege escalation in device registration means somebody could have joined a device to your tenant that you did not join. Pull the device list, sort by registration date, and look at anything from the last sixty days that you cannot account for.

The calendar caught up with October’s warnings

Last month we listed what was about to go end of life. This month it is gone, and the gap is already showing.

• Windows Server 2012 and 2012 R2 are now past the third and final year of Extended Security Updates. They got nothing today. Every Critical RCE on the board above that touches SMB, TCP/IP, RPC, Schannel, LDAP, or Print Spooler is now a permanent hole on those boxes. If you still have one, it belongs on an isolated segment with a sensor in front of it, not on the production LAN.
• Windows 11 23H2 Enterprise, Education, and IoT Enterprise received their last security update this month. Move to 25H2 or 26H2.
• Windows 11 24H2 Home and Pro ended in October. Same instruction.
• Office 2021 and Office LTSC 2021 retired October 14 with no ESU. Note that LTSC 2021 is on the affected list for the exploited Outlook zero-day. Microsoft shipped the fix anyway this once. Do not count on that next month.
• Windows 10 continues on paid ESU only. If you are not paying, you are not patched, and the Outlook zero-day works just fine on Windows 10.

Every one of those is a system that is still sitting on somebody’s network with a growing list of unpatched bugs. The list grew by 66 Critical entries today.

What we are doing about it, and what you should do

If you are a ThreatHunter.ai customer, here is where we are. Our hunters have the Outlook NTLM leak at the top of the board. We are watching for Outlook making outbound SMB and WebDAV connections to hosts it has never talked to, for NTLM authentication leaving your network, and for NTLM relay and pass-the-hash patterns on the inside: the same account authenticating from two places at once, NTLM logons to servers that should only see Kerberos, and new sessions on domain controllers from workstation subnets. We are watching your DCs for LDAP and AD DS service crashes, your Exchange servers for w3wp doing things it should not, and every host for the SMB, RPC, and TCP/IP services terminating unexpectedly, because failed exploits of those bugs leave a crash behind. If you have something in Tier 1 you cannot patch this week, tell us which host and why, and we will put eyes on it until you can. The rules we are running, the TTPs behind them, and the honest state of public intel are in the detection pack that follows, and the Sigma and KQL files are free to anyone who wants them.

If you are not a customer, do this in order:

1. Patch CVE-2026-124194 and the twenty Outlook RCEs on every endpoint today. Reboot. Verify the build, not just the KB.
2. Patch domain controllers (AD DS, LDAP, CredSSP) and Exchange in the same window. Do not wait for Saturday.
3. Turn on SMB signing and LDAP signing and channel binding everywhere, and audit where NTLM is still accepted. This is the fix that makes the next hash leak useless, and there will be a next one.
4. Walk the Tier 2 list against what is actually listening on your network. Function Discovery, SSDP, MSMQ, Print Spooler. If you do not know what is listening, that is the real finding.
5. Office, font, image, and codec parsers across the fleet this week.
6. Hyper-V and the Critical privilege escalations before month end, Hyper-V first if you run multi-tenant hosts.
7. Pull the Entra device list and look for registrations you did not make.
8. Decide the fate of every Server 2012 and 23H2 box that just stopped getting patches, before the next zero-day decides it for you.

The honest truth has not changed since October. Patch management was built for a world of 60 bugs a month, and that world is gone. November was 1,235 and it was the quiet month. The only thing that scales with the curve is knowing which handful of bugs your attacker can actually reach, patching those first, and having somebody hunting for the attacker who got there before you did. That has been our whole job since 2007.

Stay safe, patch Outlook, and go turn on SMB signing. You should have done it in 2017.

Intel status

There are no public IOCs for the Outlook zero-day as of the morning of November 11. No hashes, no domains, no sample.

Microsoft published “Exploitation Detected” and the description of what the bug does, and nobody has published how it is being delivered or by whom. So this pack is behavior-based. The behavior is unusually specific this month, which is good news: Outlook reaching out over SMB or WebDAV to a host it has never talked to is not something that happens by accident.

The prior art tells you the shape. Outlook NTLM leaks are a known state actor technique. CVE-2023-23397 needed zero clicks, landed in KEV within days, and was used for over a year. CVE-2026-32202 in April was a Windows Shell NTLM leak that took two patches. Every one of these ends the same way: the hash goes to an attacker SMB or WebDAV server, then gets cracked offline or relayed live to something that still accepts NTLM. Assume 124194 is being used the same way until Microsoft says otherwise.

TTPs we are hunting

The ten rule files

None of these rules care whether Outlook or Exchange or LDAP is installed. They fire on what the exploit has to do after it works, or on what it does when it fails. A hash or a domain only catches the one sample somebody already saw. Behavior catches the variant nobody has seen yet.

The KQL file carries thirteen hunts: the Outlook SMB and WebDAV egress join, the NTLM outbound and inbound views, the relay detector that flags one account authenticating from two IPs in five minutes, the DC crash union, a kernel bugcheck query that joins against TVM to show which crashed hosts were unpatched, a Defender engine version inventory, the Entra device registration audit, and a TVM exposure query for the top eighteen CVEs.

Deployment order

1. Rules 001 and 002 and KQL H1 to H3 today. This is the only coverage for the exploited zero-day.
2. Rule 003 today. Twenty Outlook RCEs.
3. Rule 004 on domain controllers today.
4. Rules 006 and 007 on RDP, WinRM, and Exchange hosts today.
5. Rule 005 everywhere this week.
6. Rule 008 on Hyper-V hosts this week; today if multi-tenant.
7. Rule 009 fleet-wide, and run the engine inventory now.
8. Rule 010 and KQL H12 once against sixty days of Entra audit log.

What you need turned on

Sysmon events 1, 3, 7, and 11, with Event 3 carrying Initiated and DestinationPort. Security log 4624, 4625, 4648. The NTLM Operational log, which needs the Restrict NTLM audit policies enabled. System, Application, and Defender Operational logs. For Defender shops, DeviceNetworkEvents, DeviceLogonEvents, DeviceProcessEvents, DeviceImageLoadEvents, DeviceEvents, and the two TVM tables. For Entra, the AuditLogs table.

The fix that makes the next one not matter

The pack catches the hash leaving. What makes the leak useless is SMB signing required, LDAP signing and channel binding required, and NTLM restricted or at minimum audited on every tier-0 server. Do that this month and CVE-2026-124194, and the one after it, become a phishing email that steals a hash nobody can use.

What we will add

The moment Microsoft, CISA, or a credible responder publishes samples, delivery infrastructure, or a message file structure for CVE-2026-124194, we will push indicator rules into this pack and into every customer tenant.