Microsoft November 2026 Patch Release: 1,093 Vulnerabilities Fixed, Outlook Spoofing Zero-Day CVE-2026-124194 Actively Exploited

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5691 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Outlook Outbound SMB to External Host (CVE-2026-124194 NTLMv2 Hash Leak) [Splunk SPL] — Exploitation

Detects OUTLOOK.EXE opening an outbound SMB/NetBIOS connection (TCP 445/139) to a non-private address, the behavioural signature of CVE-2026-124194 where a crafted message file makes Outlook authenticate to an attacker-controlled location and leak the user's NTLMv2 hash. No network IOCs were published for the in-the-wild exploitation, so detection is behaviour-first. CISA KEV 2026-11-10.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1187, T1203
• Data sources: sysmon, microsoft_defender_for_endpoint:DeviceNetworkEvents, windows_sysmon_network_connection
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 Initiated=true Image="*\\OUTLOOK.EXE" (DestinationPort=445 OR DestinationPort=139)
| where NOT (cidrmatch("10.0.0.0/8",DestinationIp) OR cidrmatch("172.16.0.0/12",DestinationIp) OR cidrmatch("192.168.0.0/16",DestinationIp) OR cidrmatch("169.254.0.0/16",DestinationIp) OR cidrmatch("127.0.0.0/8",DestinationIp) OR cidrmatch("fe80::/10",DestinationIp) OR cidrmatch("fc00::/7",DestinationIp) OR DestinationIp="::1")
| stats count as connections min(_time) as first_seen max(_time) as last_seen values(DestinationPort) as dest_ports by host, User, Image, DestinationIp
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S"), detection="CVE-2026-124194 Outlook forced NTLM authentication (T1187)"
| table first_seen last_seen host User Image DestinationIp dest_ports connections detection

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemotePort in (445, 139)
| where RemoteIPType == "Public"
| summarize Connections = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Ports = make_set(RemotePort) by DeviceName, InitiatingProcessAccountName, RemoteIP
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessAccountName, RemoteIP, Ports, Connections

Sigma

title: Outlook Outbound SMB Connection To External Host - CVE-2026-124194 NTLM Hash Leak
id: 3f2a8c1e-7b4d-4e6a-9c15-a1d2e3f40501
status: experimental
description: Detects OUTLOOK.EXE initiating an outbound SMB/NetBIOS session (TCP 445/139) to a non-private address. Opening a crafted message file that triggers CVE-2026-124194 makes Outlook connect to an attacker-controlled location without the normal external-content warning, disclosing the user's NTLMv2 hash.
references:
    - https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-124194
    - https://www.tenable.com/blog/microsoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.credential-access
    - attack.t1187
    - attack.execution
    - attack.t1203
    - cve.2026-124194
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\OUTLOOK.EXE'
        Initiated: 'true'
        DestinationPort:
            - 445
            - 139
    filter_private:
        DestinationIp|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - '127.0.0.0/8'
            - '::1/128'
            - 'fe80::/10'
            - 'fc00::/7'
    condition: selection and not filter_private
falsepositives:
    - Outlook opening attachments or message files hosted on a legitimate remote file server reachable over a public or NAT-translated address
    - Split-tunnel VPN clients reaching corporate file servers on non-RFC1918 space
level: high

Known false positives:

• Outlook opening attachments or message files from a legitimate remote file server reachable on a public or NAT-translated address
• Split-tunnel VPN clients reaching corporate SMB servers on non-RFC1918 address space

Tuning notes: Add your corporate public egress and partner SMB ranges to the exclusion list; extend the port list to 80/443 only if you also baseline WebClient/WebDAV traffic from Outlook; make sure Sysmon EventCode 3 logging includes OUTLOOK.EXE; block outbound 445/139 at the perimeter so remaining alerts become high-fidelity attempts.

• 🔒 Outlook Outbound SMB to External Host (CVE-2026-124194 NTLMv2 Hash Leak) [Microsoft Sentinel KQL] — Exploitation · unlock with TL Creds
• 🔒 Outlook Opened Message File From Untrusted Location (CVE-2026-124194 Lure) [Microsoft Sentinel KQL] — Post-Exploitation · unlock with TL Creds
• 🔒 NTLM Network Logon Replay Across Multiple Hosts (Post CVE-2026-124194 Hash Leak) [Microsoft Sentinel KQL] — C2 / Lateral Movement · unlock with TL Creds
• 🔒 Outlook Outbound SMB to External Host (CVE-2026-124194 NTLMv2 Hash Leak) [Sigma] — Exploitation · unlock with TL Creds
• 🔒 Outlook Opened Message File From Untrusted Location (CVE-2026-124194 Lure) [Sigma] — Post-Exploitation · unlock with TL Creds
• 🔒 NTLM Network Logon Replay Across Multiple Hosts (Post CVE-2026-124194 Hash Leak) [Sigma] — C2 / Lateral Movement · unlock with TL Creds
• 🔒 Outlook Opened Message File From Untrusted Location (CVE-2026-124194 Lure) [Splunk SPL] — Post-Exploitation · unlock with TL Creds
• 🔒 NTLM Network Logon Replay Across Multiple Hosts (Post CVE-2026-124194 Hash Leak) [Splunk SPL] — C2 / Lateral Movement · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-5691.

Technical analysis

Microsoft's November 2026 security release addressed 1,093 CVEs across 287 products/components (63 Critical, 1,029 Important, 1 Moderate per Tenable; other outlets count 1,094). Elevation of privilege accounts for roughly 48.9% and remote code execution for 27.1%. Microsoft shipped more than 1,400 fixes in October 2026 and over 5,100 year to date, and attributes the volume to AI-assisted bug discovery.

The only flaw Microsoft reports as exploited is CVE-2026-124194, a spoofing vulnerability in Microsoft Office Outlook (NVD title: 'Product ui does not warn user of unsafe actions in Microsoft Office Outlook'; CWE-356; CVSS 3.1 6.5 Medium, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). An attacker persuades a victim to open a specially crafted message file; Outlook then connects to an attacker-controlled network location without the normal external-content warning, exposing the user's NTLMv2 hash, which can be used to impersonate the user in follow-on attacks. The Preview Pane is reported not to be an attack vector. Affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021 (below 16.0.14334.21048), Office LTSC 2024 (below 16.0.17932.21140) and Outlook 2016 per secondary reporting. Microsoft has not disclosed the attackers, victims or dates. CISA added the flaw to KEV on 2026-11-10 (due 2026-11-24); SSVC lists exploitation as active, automatable as no. Tenable reports the advisory credits a researcher who used Anthropic's Claude to find the bug.

Other notable fixes: CVE-2026-116928 (Windows Search, reachable via Exchange attachment indexing; described by ZDI's Dustin Childs as a zero-click code execution bug), a 9.8-rated Windows LDAP flaw, CVE-2026-118146 (AD DS RCE, 8.8), CVE-2026-118207 (Exchange RCE, 8.8), CVE-2026-119952 (Schannel RCE, 8.1), CVE-2026-113862 (Windows NAT RCE, 8.1), CVE-2026-124185 (Word RCE) and CVE-2026-120002 (SharePoint EoP, 9.9). ZDI flagged 30 flaws as potentially wormable. None were publicly known before release.

Concurrent vendor releases: Google Chrome 157.0.8103.50 (9 fixes, including CVE-2026-125350, described by Krebs on Security as the sixth Chrome zero-day of 2026; Edge and other Chromium browsers are also fixed; Chrome's own exploitation statement could not be independently retrieved); Apple out-of-cycle updates (at least nine flaws, including iMessage group-chat issues CVE-2026-113961 and CVE-2026-113960; the related Brotli out-of-bounds write CVE-2026-111497 was added to KEV on 2026-10-27); Firefox 160 (almost 100 CVEs); and Adobe (at least 110 vulnerabilities, no known exploitation).

No network IOCs or malware were published for the in-the-wild Outlook exploitation, so detection must rely on behavioral telemetry (Outlook-initiated outbound authentication to external hosts after opening message files).

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.002 Remote Services: SMB/Windows Admin Shares; T1210 Exploitation of Remote Services; T1550.002 Pass the Hash

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1611 Escape to Host

Defense Evasion

T1078 Valid Accounts

Credential Access

T1110.002 Brute Force: Password Cracking; T1187 Forced Authentication; T1212 Exploitation for Credential Access; T1557 Adversary-in-the-Middle

Initial Access

T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment

Execution

T1203 Exploitation for Client Execution; T1204.002 Malicious File

Remediation

Patches

• Microsoft Security Update Guide: CVE-2026-124194
• Office LTSC 2021 16.0.14334.21048 or later; Office LTSC 2024 16.0.17932.21140 or later
• Chrome 157.0.8103.50
• Firefox 160

Immediate actions

• Deploy the November 2026 Microsoft security updates, prioritizing Outlook/Office builds for CVE-2026-124194 (CISA KEV due date 2026-11-24)
• Update Chrome to 157.0.8103.50 or later and update Microsoft Edge and other Chromium-based browsers
• Prioritize Exchange, Active Directory Domain Services, Windows Search, LDAP and Schannel fixes on exposed or high-value servers
• Apply Apple out-of-cycle updates (iOS/iPadOS 27.2.1) and verify installation

Workarounds

• Do not open message files (.msg) from untrusted sources
• Block outbound NTLM/SMB to external destinations until patched

Longer-term hardening

• Block outbound SMB (TCP 445) and NTLM authentication to the internet at the perimeter
• Restrict or audit NTLM usage and move to Kerberos; enable SMB signing and Extended Protection for Authentication
• Hunt for Outlook-initiated external authentication attempts and rotate credentials of users who opened suspicious message files

Affected and fixed versions

• Microsoft — Microsoft 365 Apps for Enterprise / Office LTSC (Outlook)
  Vulnerable versions: Microsoft 365 Apps for Enterprise 16.0.1; Office LTSC 2021 < 16.0.14334.21048; Office LTSC 2024 < 16.0.17932.21140; Outlook 2016
  Fixed in: Office LTSC 2021 16.0.14334.21048; Office LTSC 2024 16.0.17932.21140; Microsoft 365 Apps current security release
• Google — Chrome (and Chromium-based browsers incl. Microsoft Edge)
  Vulnerable versions: Versions prior to 157.0.8103.50
  Fixed in: 157.0.8103.50
• Apple — iOS/iPadOS, macOS, watchOS, visionOS (iMessage)
  Vulnerable versions: Versions prior to 27.2.1 (iOS/iPadOS)
  Fixed in: iOS/iPadOS 27.2.1
• Mozilla — Firefox
  Vulnerable versions: Versions prior to 160
  Fixed in: 160

Timeline

Last updated 2026-11-11 · 2 updates · revalidated 2× · latest source

• 2026-10-27 CISA adds Apple Brotli out-of-bounds write CVE-2026-111497 to the KEV catalog
• 2026-11-03 Google's prior Chrome release fixes 213 vulnerabilities
• 2026-11-09 Apple releases out-of-cycle updates fixing at least nine flaws, including iMessage group-chat issues CVE-2026-113961 and CVE-2026-113960
• 2026-11-09 Google ships Chrome 157.0.8103.50 fixing nine flaws including CVE-2026-125350, the sixth Chrome zero-day of 2026 per Krebs on Security
• 2026-11-10 CrowdStrike publishes its November 2026 Patch Tuesday analysis, citing 1,252 CVEs (68 Critical), three CVSS 9.8 unauthenticated network RCEs and eight Critical Office Preview Pane RCEs; none besides CVE-2026-124194 stated as exploited.
• 2026-11-10 Microsoft discloses Entra Device Registration EoP (CVE-2026-109469, CVSS 10.0) and Azure OpenAI EoP (CVE-2026-119990, CVSS 9.8) as already mitigated server-side; no customer action required.
• 2026-11-10 Rapid7 publishes its November 2026 Patch Tuesday analysis noting the leaked NTLMv2 hash can be relayed or cracked offline, so CVSS 6.5 understates real-world impact.
• 2026-11-10 NVD publishes CVE-2026-124194 (CVSS 6.5, CWE-356), CVE-2026-119952 (CVSS 8.1, CWE-208) and CVE-2026-116928 (CVSS 9.8, CWE-787).
• 2026-11-10 Mozilla ships Firefox 160 (almost 100 CVEs) and Adobe fixes at least 110 flaws with no known exploitation
• 2026-11-10 CISA adds CVE-2026-124194 to KEV with a remediation due date of 2026-11-24
• 2026-11-10 Microsoft releases November 2026 updates fixing 1,093 CVEs (63 Critical); CVE-2026-124194 disclosed as exploited zero-day
• 2026-11-24 CISA KEV remediation due date for CVE-2026-124194 for US federal agencies.

Update history

• 2026-11-11 — November 2026 Patch Tuesday: 1,252 CVEs incl. one exploited zero-day (CVE-2026-124194 Outlook spoofing / NTLMv2 hash leak) and 68 Critical: What changed No severity, exploitability, status, CVSS or attribution change; exploited status of CVE-2026-124194 (KEV, SSVC active) is unchanged. The update broadens coverage of the other November fixes.
• 2026-11-11 — Microsoft Patch Tuesday November 2026 - Outlook NTLMv2 hash leak spoofing (CVE-2026-124194) exploited in the wild; Schannel (CVE-2026-119952) and Windows Search (CVE-2026-116928) pre-auth RCEs: What changed No severity/exploitability/status change. New indicators (2) Indicator values are withheld at this access level.

Sources cited

• NVD CVE-2026-124194 NVD (NIST) · Advisory · 2026-11-10
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-11-10
• CVE-2026-125350 CVE Record CVE Program · Advisory · 2026-11-09
• MSRC Advisory CVE-2026-124194 Microsoft Security Response Center · Vendor report · 2026-11-10
• November 2026 Microsoft Patch Tuesday (Tenable) Tenable · Research · 2026-11-10
• Microsoft Patches Exploited Outlook Hash-Disclosure Zero-Day and Over 1,090 Flaws (Mallory) mallory.ai · Research · 2026-11-10
• Chrome Stable Channel Update for Desktop (157.0.8103.50) chromereleases.googleblog.com · Vendor report · 2026-11-09
• Microsoft Fixes Nearly 1,100 Security Vulnerabilities (Krebs on Security) Krebs on Security · News · 2026-11-10
• Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday (CyberScoop) cyberscoop.com · News · 2026-11-10
• Apple patches iMessage group chat flaws (The Hacker News) The Hacker News · News · 2026-11-10

More in vulnerability

• CVE-2026-119618: Critical Unauthenticated RCE via Race Condition in Apache HTTP Server mod_http2 assign_headers()
• Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)
• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation

Related coverage of this activity

• CVE-2026-124194 Outlook zero-day
• November 2026 Patch Tuesday

Other reports on CVE-2026-124194

• Microsoft November 2026 Patch Tuesday (1,093 bugs) - Exploited Outlook CVE-2026-124194, Barracuda CVE-2026-116606/CVE-2026-111560 (CISA-directed), N-able N-central PoC scanning

Other reports on CVE-2026-125350

• Google Chrome XML Use-After-Free Zero-Day Exploited in the Wild (CVE-2026-125350)

Previous and next in vulnerability

• SGLang RCE Exploited Against NEAR AI Inference Server — Data Stolen From 18 Agents and ~100 Users Next report