# Microsoft November 2026 Patch Release: 1,093 Vulnerabilities Fixed, Outlook Spoofing Zero-Day CVE-2026-124194 Actively Exploited

> Microsoft's November 2026 Patch Tuesday fixed 1,093 vulnerabilities (63 Critical), including CVE-2026-124194, an Outlook spoofing flaw exploited in the wild that can leak a user's NTLMv2 hash when a crafted message file is opened. CISA added it to KEV on 2026-11-10; concurrent Chrome, Apple, Firefox and Adobe updates were also released.

- **Published:** 2026-11-10T23:03:19Z
- **Last reviewed:** 2026-11-11T00:24:57.433Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5691
- **ID:** TL-2026-5691
- **Severity:** CRITICAL (CVSS 6.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 14
- **CVEs:** CVE-2026-124194, CVE-2026-125350, CVE-2026-119952, CVE-2026-116928, CVE-2026-112967, CVE-2026-119958, CVE-2026-110043, CVE-2026-110067, CVE-2026-110068, CVE-2026-111285, CVE-2026-111289, CVE-2026-111309, CVE-2026-120003, CVE-2026-124185, CVE-2026-118146, CVE-2026-118148, CVE-2026-118207, CVE-2026-119957, CVE-2026-113825, CVE-2026-113752, CVE-2026-113753, CVE-2026-109459, CVE-2026-116710, CVE-2026-109469, CVE-2026-119990

## Description

Microsoft's November 2026 security release addressed 1,093 CVEs across 287 products/components (63 Critical, 1,029 Important, 1 Moderate per Tenable; other outlets count 1,094). Elevation of privilege accounts for roughly 48.9% and remote code execution for 27.1%. Microsoft shipped more than 1,400 fixes in October 2026 and over 5,100 year to date, and attributes the volume to AI-assisted bug discovery.

The only flaw Microsoft reports as exploited is CVE-2026-124194, a spoofing vulnerability in Microsoft Office Outlook (NVD title: 'Product ui does not warn user of unsafe actions in Microsoft Office Outlook'; CWE-356; CVSS 3.1 6.5 Medium, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). An attacker persuades a victim to open a specially crafted message file; Outlook then connects to an attacker-controlled network location without the normal external-content warning, exposing the user's NTLMv2 hash, which can be used to impersonate the user in follow-on attacks. The Preview Pane is reported not to be an attack vector. Affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021 (below 16.0.14334.21048), Office LTSC 2024 (below 16.0.17932.21140) and Outlook 2016 per secondary reporting. Microsoft has not disclosed the attackers, victims or dates. CISA added the flaw to KEV on 2026-11-10 (due 2026-11-24); SSVC lists exploitation as active, automatable as no. Tenable reports the advisory credits a researcher who used Anthropic's Claude to find the bug.

Other notable fixes: CVE-2026-116928 (Windows Search, reachable via Exchange attachment indexing; described by ZDI's Dustin Childs as a zero-click code execution bug), a 9.8-rated Windows LDAP flaw, CVE-2026-118146 (AD DS RCE, 8.8), CVE-2026-118207 (Exchange RCE, 8.8), CVE-2026-119952 (Schannel RCE, 8.1), CVE-2026-113862 (Windows NAT RCE, 8.1), CVE-2026-124185 (Word RCE) and CVE-2026-120002 (SharePoint EoP, 9.9). ZDI flagged 30 flaws as potentially wormable. None were publicly known before release.

Concurrent vendor releases: Google Chrome 157.0.8103.50 (9 fixes, including CVE-2026-125350, described by Krebs on Security as the sixth Chrome zero-day of 2026; Edge and other Chromium browsers are also fixed; Chrome's own exploitation statement could not be independently retrieved); Apple out-of-cycle updates (at least nine flaws, including iMessage group-chat issues CVE-2026-113961 and CVE-2026-113960; the related Brotli out-of-bounds write CVE-2026-111497 was added to KEV on 2026-10-27); Firefox 160 (almost 100 CVEs); and Adobe (at least 110 vulnerabilities, no known exploitation).

No network IOCs or malware were published for the in-the-wild Outlook exploitation, so detection must rely on behavioral telemetry (Outlook-initiated outbound authentication to external hosts after opening message files).

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1187 Forced Authentication
- T1550.002 Pass the Hash
- T1078 Valid Accounts
- T1212 Exploitation for Credential Access
- T1557 Adversary-in-the-Middle
- T1110.002 Brute Force: Password Cracking
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1210 Exploitation of Remote Services

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Outlook Outbound SMB to External Host (CVE-2026-124194 NTLMv2 Hash Leak) [Splunk SPL] — Exploitation** (`TL-2026-5691-SPL-001`)

Detects OUTLOOK.EXE opening an outbound SMB/NetBIOS connection (TCP 445/139) to a non-private address, the behavioural signature of CVE-2026-124194 where a crafted message file makes Outlook authenticate to an attacker-controlled location and leak the user's NTLMv2 hash. No network IOCs were published for the in-the-wild exploitation, so detection is behaviour-first. CISA KEV 2026-11-10.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1187, T1203
- **Data sources:** sysmon, microsoft_defender_for_endpoint:DeviceNetworkEvents, windows_sysmon_network_connection
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 Initiated=true Image="*\\OUTLOOK.EXE" (DestinationPort=445 OR DestinationPort=139)
| where NOT (cidrmatch("10.0.0.0/8",DestinationIp) OR cidrmatch("172.16.0.0/12",DestinationIp) OR cidrmatch("192.168.0.0/16",DestinationIp) OR cidrmatch("169.254.0.0/16",DestinationIp) OR cidrmatch("127.0.0.0/8",DestinationIp) OR cidrmatch("fe80::/10",DestinationIp) OR cidrmatch("fc00::/7",DestinationIp) OR DestinationIp="::1")
| stats count as connections min(_time) as first_seen max(_time) as last_seen values(DestinationPort) as dest_ports by host, User, Image, DestinationIp
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S"), detection="CVE-2026-124194 Outlook forced NTLM authentication (T1187)"
| table first_seen last_seen host User Image DestinationIp dest_ports connections detection
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemotePort in (445, 139)
| where RemoteIPType == "Public"
| summarize Connections = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Ports = make_set(RemotePort) by DeviceName, InitiatingProcessAccountName, RemoteIP
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessAccountName, RemoteIP, Ports, Connections
```

### Sigma

```yaml
title: Outlook Outbound SMB Connection To External Host - CVE-2026-124194 NTLM Hash Leak
id: 3f2a8c1e-7b4d-4e6a-9c15-a1d2e3f40501
status: experimental
description: Detects OUTLOOK.EXE initiating an outbound SMB/NetBIOS session (TCP 445/139) to a non-private address. Opening a crafted message file that triggers CVE-2026-124194 makes Outlook connect to an attacker-controlled location without the normal external-content warning, disclosing the user's NTLMv2 hash.
references:
    - https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-124194
    - https://www.tenable.com/blog/microsoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.credential-access
    - attack.t1187
    - attack.execution
    - attack.t1203
    - cve.2026-124194
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\OUTLOOK.EXE'
        Initiated: 'true'
        DestinationPort:
            - 445
            - 139
    filter_private:
        DestinationIp|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - '127.0.0.0/8'
            - '::1/128'
            - 'fe80::/10'
            - 'fc00::/7'
    condition: selection and not filter_private
falsepositives:
    - Outlook opening attachments or message files hosted on a legitimate remote file server reachable over a public or NAT-translated address
    - Split-tunnel VPN clients reaching corporate file servers on non-RFC1918 space
level: high
```

**Known false positives:**

- Outlook opening attachments or message files from a legitimate remote file server reachable on a public or NAT-translated address
- Split-tunnel VPN clients reaching corporate SMB servers on non-RFC1918 address space

**Tuning notes:** Add your corporate public egress and partner SMB ranges to the exclusion list; extend the port list to 80/443 only if you also baseline WebClient/WebDAV traffic from Outlook; make sure Sysmon EventCode 3 logging includes OUTLOOK.EXE; block outbound 445/139 at the perimeter so remaining alerts become high-fidelity attempts.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Outlook Outbound SMB to External Host (CVE-2026-124194 NTLMv2 Hash Leak) [Microsoft Sentinel KQL] — Exploitation (locked: unlock with TL Creds)
- Outlook Opened Message File From Untrusted Location (CVE-2026-124194 Lure) [Microsoft Sentinel KQL] — Post-Exploitation (locked: unlock with TL Creds)
- NTLM Network Logon Replay Across Multiple Hosts (Post CVE-2026-124194 Hash Leak) [Microsoft Sentinel KQL] — C2 / Lateral Movement (locked: unlock with TL Creds)
- Outlook Outbound SMB to External Host (CVE-2026-124194 NTLMv2 Hash Leak) [Sigma] — Exploitation (locked: unlock with TL Creds)
- Outlook Opened Message File From Untrusted Location (CVE-2026-124194 Lure) [Sigma] — Post-Exploitation (locked: unlock with TL Creds)
- NTLM Network Logon Replay Across Multiple Hosts (Post CVE-2026-124194 Hash Leak) [Sigma] — C2 / Lateral Movement (locked: unlock with TL Creds)
- Outlook Opened Message File From Untrusted Location (CVE-2026-124194 Lure) [Splunk SPL] — Post-Exploitation (locked: unlock with TL Creds)
- NTLM Network Logon Replay Across Multiple Hosts (Post CVE-2026-124194 Hash Leak) [Splunk SPL] — C2 / Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Microsoft Fixes Nearly 1,100 Security Vulnerabilities (Krebs on Security)](https://krebsonsecurity.com/2026/11/microsoft-fixes-nearly-1100-security-vulnerabilities/)
- [MSRC Advisory CVE-2026-124194](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-124194)
- [NVD CVE-2026-124194](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-124194)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [November 2026 Microsoft Patch Tuesday (Tenable)](https://www.tenable.com/blog/microsoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194)
- [Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday (CyberScoop)](https://cyberscoop.com/microsoft-patch-tuesday-november-2026/)
- [Microsoft Patches Exploited Outlook Hash-Disclosure Zero-Day and Over 1,090 Flaws (Mallory)](https://mallory.ai/stories/01a1c711-8a44-79f4-bc44-23265055adda)
- [Chrome Stable Channel Update for Desktop (157.0.8103.50)](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html)
- [CVE-2026-125350 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-125350)
- [Apple patches iMessage group chat flaws (The Hacker News)](https://thehackernews.com/2026/11/apple-patches-imessage-group-chat.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5691