November 2026 Patch Tuesday: Outlook Zero Day Leaks NTLM Hashes

Microsoft says just one bug in its November 10 security release was already under attack, and it sits in Outlook. CVE-2026-124194 is rated only Moderate, with a CVSS score of 6.5. Three Outlook bugs in the same release are rated Critical, and none of them is under attack. That gap between severity label and real risk is the story of this release.

Key Takeaways

• CVE-2026-124194, an Outlook flaw Microsoft titles a spoofing vulnerability, was exploited before the November 10, 2026 patch, and CISA added it to its Known Exploited Vulnerabilities catalog the same day.
• Microsoft says a crafted file opened in Outlook can connect to an attacker's server "without displaying the usual external-content warning," exposing the user's NTLMv2 hash.
• BleepingComputer counts 1,235 flaws in the release and Krebs on Security counts 1,093; the difference equals the 142 Microsoft Edge flaws in BleepingComputer's tally.
• Three Critical Outlook remote code execution bugs list the Preview Pane as an attack vector, but Microsoft rates all three "Exploitation Less Likely."

How Big Is the November 2026 Patch Tuesday?

It is either 1,093 or 1,235 flaws, depending on who counts. BleepingComputer counts 1,235 with 66 rated Critical, excluding 108 fixes Microsoft shipped earlier in the month. It labels that total "record-breaking," yet its own October count was 1,411, so November is not the largest. Krebs on Security reports 1,093, with 63 Critical.

The numbers line up once you look at Edge. BleepingComputer's total includes 142 Microsoft Edge (Chromium based) flaws, three of them Critical. Subtract those and you get 1,093 and 63, Krebs's figures exactly. Krebs does not explain his count, so treat that as arithmetic, not a stated method.

Krebs notes Microsoft has shipped "more than 5,100 security patches so far this year," against about 100 a month a year ago, and that "Microsoft credits advances in artificial intelligence for helping to find (and fix) such a large volume of security bugs in recent months." We covered the 1,411 flaw release in our October 2026 Patch Tuesday breakdown.

What Is CVE-2026-124194?

CVE-2026-124194 is an Outlook flaw in which the program fails to warn the user before an unsafe network connection, classified as CWE-356. Microsoft's FAQ describes the attack this way: "An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user."

The leaked secret is named in a second answer: the bug "discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user." Two details narrow the risk. Microsoft says "the Preview Pane is not an attack vector," and that "An attacker must send a user a malicious Office file and convince them to open it."

Affected products, per the CVE record, are Microsoft 365 Apps for Enterprise, Office LTSC 2021 before build 16.0.14334.21048 and Office LTSC 2024 before build 16.0.17932.21140, on 32 bit and x64 systems.

Microsoft has not described the attacks or the attackers. Its acknowledgments credit two finders, "nono" and "Benoît Sevens using Claude with Anthropic." Sevens was also credited on October's exploited Windows Shell bug, CVE-2026-96951. Being credited does not tell you who spotted the attacks in the wild.

Why Does Microsoft Call It Spoofing?

Microsoft calls it spoofing because the stolen hash lets the attacker impersonate the victim, not because any email sender is forged. BleepingComputer says the bug was "actively exploited in attacks to steal NTLM account hashes," and that a captured hash can be "potentially cracked offline" and used against corporate accounts.

That matters for defense. DMARC, SPF and DKIM check who sent a message. They do nothing here, because the lure can come from any address and the flaw lives in what Outlook does after the file opens. Forged sender attacks are a different problem, like the iCloud flaw that passed SPF, DKIM and DMARC we covered in October.

Which Other Outlook and Exchange Bugs Were Fixed?

By our count of Microsoft's Security Update Guide, the November release lists 20 Outlook CVEs and 9 Exchange Server CVEs. The ones to know:

• CVE-2026-110043, CVE-2026-110068, CVE-2026-111309: Critical Outlook remote code execution bugs, each scored 8.8. Microsoft answers "Yes, the Preview Pane is an attack vector" for all three and rates them "Exploitation Less Likely."
• CVE-2026-118207: a Critical Exchange Server bug, also 8.8, where "An authenticated attacker with low-level access to an affected server could send a specially crafted request to execute code on the server." Microsoft rates it "Exploitation More Likely."
• CVE-2026-118146: a Critical Active Directory Domain Services remote code execution flaw, also 8.8 and "More Likely."

Why Email Users Should Care

The exploited bug is the least severe Outlook flaw on paper and the only one that matters right now. Attackers chose it over three Critical bugs that fire from the Preview Pane. Severity labels measure what a bug could do; the KEV list measures what attackers are doing.

Outlook has leaked NTLM hashes before. CVE-2023-23397 scored 9.8 in March 2023 because a crafted email triggered "automatically when it is retrieved and processed by the Outlook client," before anyone viewed it. The 2026 version needs one click, which is why it scores 6.5, and one click is a low bar for a convincing lure.

Outlook normally warns before it pulls content from outside servers, and that warning is exactly what this bug skips. Our guide to how Outlook controls external content covers those controls. Reading mail in Gmail on the web does not touch this bug, but a file that lands in a Gmail inbox and is later opened in desktop Outlook still fits Microsoft's scenario.

What Should You Do Now?

Update Office first. Microsoft's November advisory lists no workaround, so the patch is the fix.

1. Install the November Office and Microsoft 365 Apps updates and confirm LTSC builds are at or above 16.0.14334.21048 (2021) and 16.0.17932.21140 (2024).
2. Meet the KEV deadline. CISA's entry sets November 24 for federal agencies, 14 days out, against 3 days for October's Windows zero day.
3. Reduce what a leaked hash is worth. For the 2023 Outlook hash leak, Microsoft advised adding high value accounts to the Protected Users group, which "prevents the use of NTLM" but can break apps that need it, and blocking outbound TCP 445/SMB. That was 2023 guidance; the 2026 advisory names neither.
4. Treat unexpected message and Office files as hostile, even when the sender passes DMARC.
5. Patch Exchange and domain controllers for CVE-2026-118207 and CVE-2026-118146, both rated "Exploitation More Likely."