Microsoft rolled out its massive November 2026 Patch Tuesday security update, addressing 1,093 software vulnerabilities across Windows, Office, Exchange Server, and Azure services—including 63 rated critical. Chief among the fixes is CVE-2026-124194, an actively exploited zero-day spoofing flaw in Microsoft Outlook that allows unauthenticated attackers to silently leak a victim’s NTLMv2 password hashes when a maliciously crafted file is opened. The update also resolves severe 9.8-rated remote code execution bugs in Windows LDAP and Exchange-reachable Windows Search services.
About the Author
