# Microsoft November 2026 Patch Tuesday (1,093 bugs) - Exploited Outlook CVE-2026-124194, Barracuda CVE-2026-116606/CVE-2026-111560 (CISA-directed), N-able N-central PoC scanning

> Microsoft disclosed 1,093 vulnerabilities (63 critical) in its November 2026 Patch Tuesday, including one actively exploited Outlook bug (CVE-2026-124194, severity 6.5) that lets a crafted message file make Outlook connect to an attacker-controlled location and leak authentication information; CISA added it to KEV. CISA also directed federal patching and compromise investigation for chainable Barracuda CVE-2026-116606 and CVE-2026-111560, and N-able reported scanning tied to published PoC code against N-central with no confirmed customer exploitation.

- **Published:** 2026-11-10T21:19:29Z
- **Last reviewed:** 2026-11-11T11:51:20.272Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5681
- **ID:** TL-2026-5681
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 32
- **CVEs:** CVE-2026-124194, CVE-2026-116606, CVE-2026-111560, CVE-2026-104935, CVE-2026-116928

## Description

Microsoft's November 10, 2026 Patch Tuesday addressed 1,093 vulnerabilities, 63 rated critical, the second consecutive month above 1,000 (September was roughly 900-1,000 and October more than 1,400). Tenable's Satnam Narang noted Microsoft has disclosed more than 5,160 vulnerabilities year to date.

Outlook CVE-2026-124194 is the only Microsoft bug reported as exploited in the wild. It carries a severity score of 6.5. An attacker sends a specially crafted message file and convinces the user to open it; Outlook then connects to an attacker-controlled network location without the usual external-content warning. This can leak authentication information that could be used to impersonate the user and potentially sign in as them. The flaw was reported to Microsoft by Benoit Sevens, who used Anthropic's Claude in the discovery. CISA added it to the Known Exploited Vulnerabilities catalog with a federal patch deadline at the end of the month. No threat actor, campaign, or infrastructure has been publicly identified. The primary source gives no CVSS vector or CWE.

Barracuda advisory (published 2026-11-02, updated 11-05 and 11-09) covers two flaws. CVE-2026-116606 (CVSS 9.3, CVSS v4.0 per Mandiant, CWE-288) is a pre-authentication authorization bypass affecting only the Email Security Gateway (ESG); the vulnerable function is the configuration-import (backup restore) routine, which can be fed a crafted backup to overwrite global configuration. Barracuda corrected its advisory on Nov 5 to state no authentication is required but the Admin UI must be reachable. CVE-2026-111560 (CVSS 8.6, CWE-78) is OS command injection via the timezone field, reachable with administrative access, running as root, affecting ESG, Load Balancer ADC, Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF) and Web Security Gateway (WSG). Chained, they give unauthenticated root on ESG. Barracuda's Nov 9 update reports exploitation affecting a small number of organizations, and CISA ordered federal agencies to patch by Friday and investigate potential compromise for both bugs. Patch IDs: BNSF-40425 (ESG 9.4.017+), BNSF-40430 (ESG <9.4.017), BNADC-16586 (ADC and WAF), BNMA-32468 (BMA), BNWF-60060 (WCC), BNYF-24789 (WSG). Version strings differ between Mandiant's CNA record (ESG earlier than 9.4.0.030) and Barracuda build numbers, so verify on-device.

N-able N-central: a researcher published a repository and proof-of-concept code (named able2shell) alleging more than 30 serious vulnerabilities in the remote monitoring and management platform; no CVE numbers were given in the source. N-able took all hosted N-central environments (classic) offline, told on-premises customers to turn off their servers, and stated it observes scanning activity associated with the published PoC code but has no evidence any customer environment was successfully exploited. Because RMM platforms hold privileged access to managed endpoints, exposure of internet-facing N-central servers is high risk. Ivanti Connect Secure CVE-2026-104935 and Chrome, Cisco and Adobe updates were also released this cycle but are outside this record's scope.

No malware families, threat actors, or network IOCs are published in the sources. IOC entries below are therefore product, patch-identifier, behavioral and entity indicators that defenders can hunt on.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1059.004 Unix Shell
- T1187 Forced Authentication
- T1078 Valid Accounts
- T1565.001 Stored Data Manipulation
- T1550.002 Use Alternate Authentication Material
- T1098 Account Manipulation
- T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
- T1110.002 Brute Force: Password Cracking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Outlook CVE-2026-124194 Outbound SMB to External Host (Authentication Leak)** (`TL-2026-5681-SPL-003`)

Detects OUTLOOK.EXE initiating SMB (TCP 445/139) connections to public addresses. CVE-2026-124194 (CISA KEV, exploited in the wild) makes Outlook connect to an attacker-controlled location when a crafted message file is opened, without the usual external-content warning, leaking NTLM authentication material that can be relayed or cracked to impersonate the user.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1187, T1203
- **Data sources:** sysmon, windows_network_connection, defender_xdr
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 Image="*\\OUTLOOK.EXE" (DestinationPort=445 OR DestinationPort=139)
| where NOT (cidrmatch("10.0.0.0/8",DestinationIp) OR cidrmatch("172.16.0.0/12",DestinationIp) OR cidrmatch("192.168.0.0/16",DestinationIp) OR cidrmatch("127.0.0.0/8",DestinationIp) OR cidrmatch("169.254.0.0/16",DestinationIp))
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(DestinationPort) as ports by host User DestinationIp
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemotePort in (445, 139) and RemoteIPType == "Public"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Outlook Outbound SMB Connection to External IP CVE-2026-124194
id: c2e8b7f1-6d34-4a95-b1f7-5681a0000003
status: experimental
description: Detects OUTLOOK.EXE connecting to SMB ports on non-private addresses, the authentication-leak behavior of exploited Outlook vulnerability CVE-2026-124194.
references:
    - https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
    - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194
    - https://uptime.n-able.com/event/202580/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.credential-access
    - attack.t1187
    - attack.execution
    - attack.t1203
    - cve.2026.124194
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\OUTLOOK.EXE'
        Initiated: 'true'
        DestinationPort:
            - 445
            - 139
    filter_private:
        DestinationIp|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.0/8'
            - '169.254.0.0/16'
    condition: selection and not filter_private
falsepositives:
    - Organizations that intentionally host SMB shares on public cloud addresses accessed from Outlook
    - VPN split-tunnel address ranges not listed as private
level: high

```

**Known false positives:**

- Outlook opening attachments or links on SMB shares hosted on public cloud IPs by design
- Corporate address space outside RFC1918 treated as external

**Tuning notes:** Add organization-owned public ranges to the exclusion. Alert immediately on a first-ever external SMB destination for a user and reset credentials of affected users. Block outbound TCP 445 and WebDAV at the perimeter and enable SMB signing / Extended Protection to reduce NTLM exposure.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Outlook CVE-2026-124194 Crafted .msg File Followed by External SMB Connection (locked: unlock with TL Creds)
- Barracuda Admin Interface Session from Previously Unseen Source (CVE-2026-116606 / CVE-2026-111560 Chain) (locked: unlock with TL Creds)
- N-able N-central able2shell PoC Scanning Burst (locked: unlock with TL Creds)
- Barracuda Appliance Web Daemon Spawning Shell with Download or Reverse-Shell Command (Root Post-Exploitation) (locked: unlock with TL Creds)
- Outlook Launched on Message File from Download or Cache Path (CVE-2026-124194 Delivery) (locked: unlock with TL Creds)
- able2shell N-central PoC Tool Artifact on Host (locked: unlock with TL Creds)
- Barracuda CVE-2026-111560 Timezone Field OS Command Injection (Root RCE) (locked: unlock with TL Creds)
- Barracuda ESG CVE-2026-116606 Unexpected Configuration Import / Backup Restore (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Microsoft's Patch Tuesday surpasses 1,000 bugs for second month in a row (The Record)](https://therecord.media/patch-tuesday-microsoft-1000-bugs-again)
- [MSRC Update Guide - CVE-2026-124194](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194)
- [Barracuda advisory: Pre-Authentication Authorization Bypass and Command Injection](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection)
- [Rescana: Barracuda ESG CVE-2026-116606 / CVE-2026-111560 analysis](https://www.rescana.com/post/barracuda-esg-cve-2026-116606-111560-root-prepare-now)
- [BleepingComputer: Barracuda warns of critical flaws allowing root access to devices](https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/)
- [SecurityWeek: Barracuda Email Security Gateway authentication bypass opens path to root](https://www.securityweek.com/barracuda-email-security-gateway-authentication-bypass-opens-path-to-root/)
- [Field Effect: Barracuda ESG flaws root access](https://fieldeffect.com/blog/barracuda-esg-flaws-root-access)
- [N-able status page event 202580](https://uptime.n-able.com/event/202580/)
- [able2shell N-central research post (LinkedIn)](https://www.linkedin.com/posts/seanbales_today-i-bring-you-able2shell-a-repository-ugcPost-7525411483350970368-x331/)
- [Ivanti Connect Secure advisory CVE-2026-104935](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US)
- [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5681