Microsoft November 2026 Patch Tuesday (1,093 bugs) - Exploited Outlook CVE-2026-124194, Barracuda CVE-2026-116606/CVE-2026-111560 (CISA-directed), N-able N-central PoC scanning

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5681 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Outlook CVE-2026-124194 Outbound SMB to External Host (Authentication Leak)

Detects OUTLOOK.EXE initiating SMB (TCP 445/139) connections to public addresses. CVE-2026-124194 (CISA KEV, exploited in the wild) makes Outlook connect to an attacker-controlled location when a crafted message file is opened, without the usual external-content warning, leaking NTLM authentication material that can be relayed or cracked to impersonate the user.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1187, T1203
• Data sources: sysmon, windows_network_connection, defender_xdr
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 Image="*\\OUTLOOK.EXE" (DestinationPort=445 OR DestinationPort=139)
| where NOT (cidrmatch("10.0.0.0/8",DestinationIp) OR cidrmatch("172.16.0.0/12",DestinationIp) OR cidrmatch("192.168.0.0/16",DestinationIp) OR cidrmatch("127.0.0.0/8",DestinationIp) OR cidrmatch("169.254.0.0/16",DestinationIp))
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(DestinationPort) as ports by host User DestinationIp
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemotePort in (445, 139) and RemoteIPType == "Public"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: Outlook Outbound SMB Connection to External IP CVE-2026-124194
id: c2e8b7f1-6d34-4a95-b1f7-5681a0000003
status: experimental
description: Detects OUTLOOK.EXE connecting to SMB ports on non-private addresses, the authentication-leak behavior of exploited Outlook vulnerability CVE-2026-124194.
references:
    - https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
    - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194
    - https://uptime.n-able.com/event/202580/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.credential-access
    - attack.t1187
    - attack.execution
    - attack.t1203
    - cve.2026.124194
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\OUTLOOK.EXE'
        Initiated: 'true'
        DestinationPort:
            - 445
            - 139
    filter_private:
        DestinationIp|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.0/8'
            - '169.254.0.0/16'
    condition: selection and not filter_private
falsepositives:
    - Organizations that intentionally host SMB shares on public cloud addresses accessed from Outlook
    - VPN split-tunnel address ranges not listed as private
level: high

Known false positives:

• Outlook opening attachments or links on SMB shares hosted on public cloud IPs by design
• Corporate address space outside RFC1918 treated as external

Tuning notes: Add organization-owned public ranges to the exclusion. Alert immediately on a first-ever external SMB destination for a user and reset credentials of affected users. Block outbound TCP 445 and WebDAV at the perimeter and enable SMB signing / Extended Protection to reduce NTLM exposure.

• 🔒 Outlook CVE-2026-124194 Crafted .msg File Followed by External SMB Connection · unlock with TL Creds
• 🔒 Barracuda Admin Interface Session from Previously Unseen Source (CVE-2026-116606 / CVE-2026-111560 Chain) · unlock with TL Creds
• 🔒 N-able N-central able2shell PoC Scanning Burst · unlock with TL Creds
• 🔒 Barracuda Appliance Web Daemon Spawning Shell with Download or Reverse-Shell Command (Root Post-Exploitation) · unlock with TL Creds
• 🔒 Outlook Launched on Message File from Download or Cache Path (CVE-2026-124194 Delivery) · unlock with TL Creds
• 🔒 able2shell N-central PoC Tool Artifact on Host · unlock with TL Creds
• 🔒 Barracuda CVE-2026-111560 Timezone Field OS Command Injection (Root RCE) · unlock with TL Creds
• 🔒 Barracuda ESG CVE-2026-116606 Unexpected Configuration Import / Backup Restore · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 32 indicators of compromise for TL-2026-5681.

Technical analysis

CISA also directed federal patching and compromise investigation for chainable Barracuda CVE-2026-116606 and CVE-2026-111560, and N-able reported scanning tied to published PoC code against N-central with no confirmed customer exploitation.

Microsoft's November 10, 2026 Patch Tuesday addressed 1,093 vulnerabilities, 63 rated critical, the second consecutive month above 1,000 (September was roughly 900-1,000 and October more than 1,400). Tenable's Satnam Narang noted Microsoft has disclosed more than 5,160 vulnerabilities year to date.

Outlook CVE-2026-124194 is the only Microsoft bug reported as exploited in the wild. It carries a severity score of 6.5. An attacker sends a specially crafted message file and convinces the user to open it; Outlook then connects to an attacker-controlled network location without the usual external-content warning. This can leak authentication information that could be used to impersonate the user and potentially sign in as them. The flaw was reported to Microsoft by Benoit Sevens, who used Anthropic's Claude in the discovery. CISA added it to the Known Exploited Vulnerabilities catalog with a federal patch deadline at the end of the month. No threat actor, campaign, or infrastructure has been publicly identified. The primary source gives no CVSS vector or CWE.

Barracuda advisory (published 2026-11-02, updated 11-05 and 11-09) covers two flaws. CVE-2026-116606 (CVSS 9.3, CVSS v4.0 per Mandiant, CWE-288) is a pre-authentication authorization bypass affecting only the Email Security Gateway (ESG); the vulnerable function is the configuration-import (backup restore) routine, which can be fed a crafted backup to overwrite global configuration. Barracuda corrected its advisory on Nov 5 to state no authentication is required but the Admin UI must be reachable. CVE-2026-111560 (CVSS 8.6, CWE-78) is OS command injection via the timezone field, reachable with administrative access, running as root, affecting ESG, Load Balancer ADC, Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF) and Web Security Gateway (WSG). Chained, they give unauthenticated root on ESG. Barracuda's Nov 9 update reports exploitation affecting a small number of organizations, and CISA ordered federal agencies to patch by Friday and investigate potential compromise for both bugs. Patch IDs: BNSF-40425 (ESG 9.4.017+), BNSF-40430 (ESG <9.4.017), BNADC-16586 (ADC and WAF), BNMA-32468 (BMA), BNWF-60060 (WCC), BNYF-24789 (WSG). Version strings differ between Mandiant's CNA record (ESG earlier than 9.4.0.030) and Barracuda build numbers, so verify on-device.

N-able N-central: a researcher published a repository and proof-of-concept code (named able2shell) alleging more than 30 serious vulnerabilities in the remote monitoring and management platform; no CVE numbers were given in the source. N-able took all hosted N-central environments (classic) offline, told on-premises customers to turn off their servers, and stated it observes scanning activity associated with the published PoC code but has no evidence any customer environment was successfully exploited. Because RMM platforms hold privileged access to managed endpoints, exposure of internet-facing N-central servers is high risk. Ivanti Connect Secure CVE-2026-104935 and Chrome, Cisco and Adobe updates were also released this cycle but are outside this record's scope.

No malware families, threat actors, or network IOCs are published in the sources. IOC entries below are therefore product, patch-identifier, behavioral and entity indicators that defenders can hunt on.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Unix Shell; T1203 Exploitation for Client Execution; T1204.002 Malicious File

Defense Evasion

T1078 Valid Accounts

Persistence

T1098 Account Manipulation

Credential Access

T1110.002 Brute Force: Password Cracking; T1187 Forced Authentication; T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay

Initial Access

T1190 Exploit Public-Facing Application; T1566 Phishing

Lateral Movement

T1550.002 Use Alternate Authentication Material

Impact

T1565.001 Stored Data Manipulation

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Patches

• Microsoft November 2026 security updates (CVE-2026-124194)
• Barracuda BNSF-40425, BNSF-40430, BNADC-16586, BNMA-32468, BNWF-60060, BNYF-24789
• N-able hosted environments restored by vendor; follow N-able status page and release notes for on-premises fixes

Immediate actions

• Apply the November 2026 Microsoft Office/Outlook security update that fixes CVE-2026-124194 on all Outlook for Windows clients
• Apply Barracuda patches (ESG BNSF-40425/BNSF-40430, ADC/WAF BNADC-16586, BMA BNMA-32468, WCC BNWF-60060, WSG BNYF-24789) and verify firmware build on-device
• Restrict Barracuda administrative interfaces to trusted internal networks; remove internet exposure of Admin UI
• Export Barracuda logs before patching, then investigate for unexpected configuration imports/restores, timezone changes and admin sessions from unexpected IPs
• Take internet-facing N-able N-central servers offline or restrict access until N-able guidance is followed; monitor for PoC scanning
• Block outbound SMB (TCP 445) and WebDAV to the internet to limit authentication leakage from Outlook

Workarounds

• Limit Barracuda admin UI reachability via network access controls
• Disable or isolate N-central servers exposed to the internet until patched
• Reset credentials of users who opened untrusted message files if exploitation of CVE-2026-124194 is suspected

Longer-term hardening

• Enable automatic patching on Barracuda appliances
• Compare current ESG configuration against a known-good backup
• Reduce NTLM usage and enable SMB signing / Extended Protection where feasible
• Place RMM and email-security management planes behind VPN or zero-trust access

Affected and fixed versions

• Microsoft — Outlook
  Vulnerable versions: Versions addressed by the November 2026 update (see MSRC CVE-2026-124194)
  Fixed in: November 2026 security update
• Barracuda — Email Security Gateway (ESG)
  Vulnerable versions: Earlier than 9.4.0.030 (CVE-2026-116606, per Mandiant CNA); 9.4.0.27 and earlier (CVE-2026-111560)
  Fixed in: BNSF-40425 (9.4.017+); BNSF-40430 (<9.4.017)
• Barracuda — Load Balancer ADC / Web Application Firewall
  Vulnerable versions: ADC 6.4.0 and earlier; WAF 11.0.1 and earlier
  Fixed in: BNADC-16586
• Barracuda — Message Archiver / WAF Control Center / Web Security Gateway
  Vulnerable versions: BMA 5.5.4.0 and earlier; WCC 2.2.1 and earlier; WSG 16.1.100.100 and earlier
  Fixed in: BNMA-32468; BNWF-60060; BNYF-24789
• N-able — N-central (hosted classic and on-premises)
  Vulnerable versions: Versions affected by the able2shell PoC; no CVE published in source
  Fixed in: See N-able status page

Timeline

Last updated 2026-11-11 · 3 updates · revalidated 3× · latest source

• 2026-10-15 Barracuda receives the report for CVE-2026-111560 (per Mandiant)
• 2026-10-22 Barracuda receives the report for CVE-2026-116606 (per Mandiant)
• 2026-11-02 Barracuda publishes advisory and patches for CVE-2026-116606 and CVE-2026-111560; Mandiant publishes CVE records
• 2026-11-03 Neither Barracuda CVE is in CISA KEV (catalog 2026.10.30); SSVC shows exploitation none
• 2026-11-05 Barracuda corrects advisory: CVE-2026-116606 requires no authentication but Admin UI must be reachable
• 2026-11-09 Public Nuclei template for CVE-2026-116606 detected; Previdian records first exploitation attempts the same day.
• 2026-11-09 Barracuda updates advisory reporting exploitation affecting a small number of organizations
• 2026-11-10 Windows security update KB5132061 released for the November 2026 cycle.
• 2026-11-10 Microsoft also fixes CVE-2026-116928 (Windows Search Component out-of-bounds write, CVSS 9.8; Exchange attachment-indexing scenario needing no user interaction). Microsoft reports no exploitation.
• 2026-11-10 CISA adds Barracuda CVE-2026-116606 and CVE-2026-111560 to the KEV catalog (SSVC: exploitation active, technical impact total; CVE-2026-116606 automatable).
• 2026-11-10 NVD publishes CVE-2026-124194 (CVSS 3.1 6.5, CWE-356) with affected Microsoft 365 Apps, Office LTSC 2021 and LTSC 2024 builds.
• 2026-11-10 N-able takes hosted N-central environments offline and tells customers to turn off servers, citing scanning tied to published able2shell PoC code; no confirmed customer exploitation
• 2026-11-10 CISA orders federal agencies to patch Barracuda CVE-2026-116606 and CVE-2026-111560 by Friday and investigate potential compromise
• 2026-11-10 Microsoft Patch Tuesday fixes 1,093 vulnerabilities (63 critical) including exploited Outlook CVE-2026-124194, added to CISA KEV
• 2026-11-11 Malwarebytes publishes analysis that the Outlook flaw CVE-2026-124194 is under active attack. No IOCs or attribution are given. It urges prioritized patching through Office Update Options.
• 2026-11-11 Previdian reports 17 exploitation attempts against CVE-2026-116606 from 15 source IPs in FR, SI and US between 2026-11-09 and 2026-11-11; SecurityWeek reports the exploitation.
• 2026-11-24 CISA BOD 26-04 remediation deadline for federal agencies to patch Outlook CVE-2026-124194.

Update history

• 2026-11-11 — Outlook NTLMv2 hash exposure flaw CVE-2026-124194 exploited in the wild; fixed in November 2026 Patch Tuesday: What changed No change to severity (CRITICAL), exploitability (ACTIVE) or status. The record gains one co-patched critical Windows flaw and supporting detail. New indicators (5) Indicator values are withheld at this access level.
• 2026-11-11 — Barracuda ESG Authentication Bypass and OS Command Injection (CVE-2026-116606, CVE-2026-111560) Exploited in the Wild: What changed Severity HIGH - CRITICAL and CVSS 6.5 - 9.3 (Barracuda CVE-2026-116606, CVSS 4.0) now that both Barracuda CVEs are in CISA KEV with confirmed in-the-wild exploitation. Exploitability already ACTIVE; status unchanged.
• 2026-11-11 — Microsoft Patch Tuesday (Nov 2026): 1,259 Flaws Patched Including Exploited Outlook Spoofing Bug CVE-2026-124194 (NTLMv2 Hash Exposure): What changed CVSS score set from null to 6.5 (NVD, CVSS 3.1, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Severity and exploitability are unchanged: HIGH and ACTIVE.

Sources cited

• CISA Known Exploited Vulnerabilities catalog CISA · Government advisory · 2026-11-10
• MSRC Update Guide - CVE-2026-124194 Microsoft Security Response Center · Vendor report · 2026-11-10
• Barracuda advisory: Pre-Authentication Authorization Bypass and Command Injection trust.barracuda.com · Vendor report · 2026-11-02
• Rescana: Barracuda ESG CVE-2026-116606 / CVE-2026-111560 analysis rescana.com · Research · 2026-11-03
• N-able status page event 202580 uptime.n-able.com · Vendor report · 2026-11-10
• able2shell N-central research post (LinkedIn) linkedin.com · Research · 2026-11-10
• Ivanti Connect Secure advisory CVE-2026-104935 Ivanti · Vendor report · 2026-11-10
• Field Effect: Barracuda ESG flaws root access fieldeffect.com · Blog · 2026-11-04
• Microsoft's Patch Tuesday surpasses 1,000 bugs for second month in a row (The Record) The Record · News · 2026-11-10
• BleepingComputer: Barracuda warns of critical flaws allowing root access to devices BleepingComputer · News · 2026-11-03
• SecurityWeek: Barracuda Email Security Gateway authentication bypass opens path to root SecurityWeek · News · 2026-11-03

More in vulnerability

• CVE-2026-119618: Critical Unauthenticated RCE via Race Condition in Apache HTTP Server mod_http2 assign_headers()
• Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)
• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation

Other reports on CVE-2026-124194

• Microsoft Patch Tuesday November 2026: ~1,095 vulnerabilities, 64 critical, one exploited Outlook NTLM-leak spoofing zero-day (CVE-2026-124194)
• Microsoft November 2026 Patch Release: 1,093 Vulnerabilities Fixed, Outlook Spoofing Zero-Day CVE-2026-124194 Actively Exploited
• Microsoft November 2026 Patch Tuesday: Outlook Zero-Day CVE-2026-124194 Exploited to Steal NTLM Hashes (1,235 Flaws Fixed)

Other reports on CVE-2026-116606

• Barracuda critical flaws (CVE-2026-116606, CVE-2026-111560) allow root access to ESG, ADC, Message Archiver, WAF and Web Security Gateway devices