"An attacker sends a specially crafted message file and gets the user to open it. Outlook then connects to a network location the attacker controls, but it skips the usual warning about external content," Action1 director of vulnerability research Jack Bicer explained.
Microsoft's November Patch Tuesday: 1,235 vulnerabilities
Microsoft on Patch Tuesday released fixes for 1,235 distinct flaws across its product portfolio — a new record and the fourth time this year the company has passed a monthly high-water mark, following similar milestones in July, September and October. Among the 1,235 fixes is a single zero-day that was being actively exploited in the wild at the time of the release.
The composition of this month's set of CVEs is heavily skewed toward privilege escalation: 536 of the patched entries are elevation of privilege (EoP) issues. Remote code execution (RCE) vulnerabilities account for 296 entries, and information disclosure defects number 157. A total of 66 vulnerabilities were rated critical, most of those classified as remote code execution flaws.
CVE-2026-124194: Outlook spoofing used to steal NTLM account hashes
The zero-day tracked as CVE-2026-124194 is described as a spoofing bug in Microsoft Outlook that attackers have exploited to steal NTLM account hashes. According to the reporting, exploitation begins when "an attacker sends a specially crafted message file and gets the user to open it," at which point Outlook connects to a network location controlled by the attacker and bypasses the normal external-content warning.
That silent connection is capable of leaking the user's NTLMv2 hash — a scrambled form of the user's login secret — which an attacker can reuse to sign in as that person, the source reports. The flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Although the vulnerability carries a "moderate" rating, Bicer urged immediate prioritization: "Attackers are already exploiting it, it needs only one click on an email file, and it hits Outlook, which nearly every organization runs."
His operational advice was terse and prescriptive: "Push the Office update to every Outlook user now, starting with administrators and high-value accounts."
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogSAP's November Patch Day: 43 fixes, four with CVSS 10.0
Microsoft was not alone in issuing a heavy patch load. SAP's November Patch Day was reported as the largest ever for that vendor, addressing 43 vulnerabilities in a single release. The batch included 12 Hot News Notes — the highest priority ranking SAP assigns to security updates — and 13 High Priority notes.
Onapsis, cited in the reporting, said the November patch load was "twice the size of the average for 2026" and that four of the SAP fixes carried the maximum CVSS score of 10.0. Those four are:
- CVE-2026-89103 (SAP Security Note #3798345) — a broken access control vulnerability in SAP Gateway dubbed "ProxyGate"
- CVE-2026-76964 (SAP Security Note #3778530) — a memory corruption flaw in SAP NetWeaver AS ABAP (Internet Communication Manager)
- CVE-2026-89126 (SAP Security Note #3778556) — a memory corruption vulnerability in SAP Web Dispatcher
- CVE-2026-120017 (SAP Security Note #3849308) — a missing authentication (SAML2 authentication bypass) vulnerability in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)
Distribution of flaw types and criticality
The November Microsoft and SAP releases together underscored a mix of threat vectors. For Microsoft, the single largest category was elevation of privilege (536 CVEs), followed by remote code execution (296) and information disclosure (157). Sixty-six Microsoft CVEs were rated critical, with most of those critical ratings assigned to remote code execution flaws. SAP's set emphasized high-severity items, including four CVSS 10.0 vulnerabilities and multiple Hot News designations.
What this means for sysadmins, affected enterprises, and end users
Sysadmins: The reporting carries an explicit operational priority — treat CVE-2026-124194 as urgent despite its "moderate" score because it is already being exploited, requires only a single click, and targets Outlook installations. Bicer's direction is to "push the Office update to every Outlook user now, starting with administrators and high-value accounts."
Affected enterprises and procurement leaders: Organizations running Microsoft 365 Apps for Enterprise or Office LTSC 2021 and 2024 should prioritize the Outlook update to prevent NTLM hash leaks, and they should account for the broader patch volume this month when scheduling deployment windows across endpoints and servers.
End users: The exploitation chain reported relies on opening a malicious message file and thereby initiating a connection that bypasses the usual external-content warning. That single action is sufficient, per the reporting, to expose a user's NTLMv2 hash to an attacker-controlled location.
November's simultaneous record-setting releases from Microsoft and SAP — the fourth record month for Microsoft this year and the largest-ever SAP Patch Day — create a concentrated patch workload that centers on a single actionable threat: CVE-2026-124194. The concrete next step offered in the reporting is straightforward: apply the Office update for Outlook without delay, beginning with administrators and other high-value accounts, to close the actively exploited vector for NTLM hash theft.
https://www.infosecurity-magazine.com/news/microsoft-fixes-1235-flaws-record/
