“Maybe we should just go home.” Jake Knott, head of threat intelligence at exposure management firm watchTowr, captured the exasperation many defenders felt this week after Microsoft fixed 1,094 vulnerabilities in its November Patch Tuesday release.
CVE-2026-124194 — an Outlook bug already listed as exploited
Microsoft flagged a single vulnerability in this batch as exploited: CVE-2026-124194, an Outlook spoofing flaw given a 6.5 CVSS score. Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, warned the label “spoofing” understates the impact: a specially crafted message file causes Outlook to connect to an attacker-controlled network location without presenting the usual external-content warning, disclosing the user’s NTLMv2 hash. “The attacker can use that hash to authenticate as the user,” Childs wrote.
Microsoft marked CVE-2026-124194 as exploited but, as Redmond typically does, did not publish when the attacks started, who is exploiting it, or what the attackers are doing post-exploitation. The Register’s coverage also notes that the availability of a public fix will likely accelerate scanning and patch-diffing by other attackers looking to create exploits.
Zero-click remote-code-execution risks: CVE-2026-116928 and CVE-2026-119958
This Patch Tuesday includes at least two zero-click critical vulnerabilities carrying 9.8 CVSS scores. CVE-2026-116928 is an out-of-bounds write in the Microsoft Windows Search Component that could lead to remote code execution: an unauthenticated actor can exploit Exchange by sending an email with a specially crafted attachment that Exchange indexes automatically, without the recipient opening the message or attachment. Successful exploitation could execute code with the permissions of the affected processing service.
CVE-2026-119958 is an out-of-bounds write in Windows’ LDAP implementation that likewise allows unauthenticated remote code execution. Exploitation can occur by sending specially crafted LDAP requests to vulnerable systems, with the potential to compromise domain controllers.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWormable risk and a gaming-related RCE: CVE-2026-112967
TrendAI’s Childs also identified 30 vulnerabilities in the package that pose a “wormable risk” — vulnerabilities requiring no authentication and no user interaction over a network — and advises prioritizing those fixes. Separately, a critical heap-overflow flaw in the Windows Xbox Live Networking Service, CVE-2026-112967, carries a 9.8 CVSS and can allow remote code execution with no authentication or user interaction. The Register tersely advised that systems running that service should be included in November’s patching list.
Back-to-back months above 1,000 CVEs and automated bug-hunting
November’s 1,094 CVEs follow October’s 1,474 — two consecutive months over the 1,000 mark. Childs calls this pattern proof that “automated bug-hunting has permanently reset patch volume” and warns that “with AI making patch-diffing and exploit generation near-instant, the threat window opens the minute these updates drop.” He argues defenders should not rely on the absence of public exploit reports as comfort, because automated tooling can convert patches into exploits quickly.
What this means for technologists and security teams, affected enterprises and procurement leaders, and end users
- Technologists and security teams: Childs urges abandoning broad triage in favor of immediate defensive actions — patch Exchange and Domain Controllers (LDAP/Kerberos) first to prevent zero-click compromise, ring-fence exposed services such as DNS and DHCP to limit wormable spread, and verify manual administrative fixes on cloud services. Watch for suspicious files in inboxes, and prioritize CVE-2026-124194 despite its moderate CVSS score.
- Affected enterprises and procurement leaders: The rapid increase in high-volume CVE releases, combined with automated exploit generation, means procurement and patch-planning should account for elevated operational and testing demands. Include the Xbox Live Networking Service and other nonstandard Windows services in asset inventories to ensure no vulnerable instances are overlooked.
- End users and the general public: Because the Outlook vulnerability can disclose an NTLMv2 hash via a message file opened in Outlook, users should be cautious about unexpected message files and report suspicious emails to IT. Patching by administrators reduces the risk that an opened message or automated processing will yield account authentication to attackers.
A pointed next step
Microsoft’s November fixes leave a clear prioritization: patch the exploited Outlook flaw (CVE-2026-124194) and the zero-click, wormable, and domain-controller-focused bugs first. Childs’ practical prescription — patch Exchange and domain controllers, ring-fence DNS/DHCP, and verify cloud administrative fixes — is anchored to the month’s most acute risks. As the Register notes, now that fixes are public “other miscreants are undoubtedly already scanning for vulnerable versions and reverse engineering the patch,” so defenders who can move fastest will reduce the window in which automated tooling turns fixes into weaponized exploits. Microsoft’s decision to mark one bug exploited leaves open questions about the attackers and the timeline; those details, the Register observes, “will likely start trickling out soon.”
