Threat reportVulnerabilityTL-2026-5711
Microsoft Patch Tuesday November 2026: ~1,095 vulnerabilities, 64 critical, one exploited Outlook NTLM-leak spoofing zero-day (CVE-2026-124194)
Microsoft's November 2026 Patch Tuesday (10 Nov 2026) fixed roughly 1,095 vulnerabilities per Cisco Talos (other trackers report 1,092-1,094), 64 rated critical and 48 of those RCE. One flaw, CVE-2026-124194 (Outlook spoofing, CVSS 6.5), is exploited in the wild and was added to CISA KEV with a 24 Nov 2026 federal deadline.
Key facts
Detection coverage
As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5711 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Outlook Outbound SMB/NTLM to External Host - CVE-2026-124194 NTLMv2 Leak (Exploitation)
Detects OUTLOOK.EXE initiating SMB (445/139) connections to a non-private destination, the observable behaviour of CVE-2026-124194 (Outlook spoofing, CWE-356) where opening a crafted message file makes Outlook silently authenticate to an attacker-controlled location and leak the user's NTLMv2 hash. The leaked hash can be relayed (T1557) or cracked offline. Outlook has no legitimate reason to speak SMB to the internet, so any hit warrants triage of the user and the message file opened. CISA KEV deadline 2026-11-24.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1187, T1212, T1566.001, T1204.002
- Data sources: sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 3), DeviceNetworkEvents (Microsoft Defender for Endpoint), sigma logsource network_connection/windows
- Severity: critical
- Confidence: high
Splunk SPL
```Outlook forced NTLM authentication CVE-2026-124194 (T1187) - OUTLOOK.EXE initiating SMB to a non-RFC1918 host```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 Initiated=true Image="*OUTLOOK.EXE" (DestinationPort=445 OR DestinationPort=139)
| where NOT (cidrmatch("10.0.0.0/8",DestinationIp) OR cidrmatch("172.16.0.0/12",DestinationIp) OR cidrmatch("192.168.0.0/16",DestinationIp) OR cidrmatch("169.254.0.0/16",DestinationIp) OR cidrmatch("127.0.0.0/8",DestinationIp))
| stats count min(_time) as first_seen max(_time) as last_seen values(DestinationPort) as dest_ports by host, User, Image, DestinationIp
| convert ctime(first_seen) ctime(last_seen)
| eval cve="CVE-2026-124194", mitre="T1187,T1212"Microsoft KQL
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemotePort in (445, 139)
| where RemoteIPType == "Public"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, ActionType
| order by Timestamp descSigma
title: Outlook Initiating External SMB Connection - CVE-2026-124194 NTLM Leak
id: 7b1f3c52-8d0e-4a6b-9e41-2c5a6f0d8b13
status: experimental
description: Detects OUTLOOK.EXE connecting to a non-private host over SMB (445/139), indicating forced NTLM authentication such as CVE-2026-124194 where a crafted message file leaks the user's NTLMv2 hash.
references:
- https://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Threadlinqs Team
date: 2026/11/11
tags:
- attack.credential-access
- attack.t1187
- attack.t1212
- attack.initial-access
- attack.t1566.001
- cve.2026.124194
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: '\outlook.exe'
Initiated: 'true'
DestinationPort:
- 445
- 139
filter_private:
DestinationIp|cidr:
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
- '169.254.0.0/16'
- '127.0.0.0/8'
condition: selection and not filter_private
falsepositives:
- Outlook opening a UNC-path attachment hosted on a legitimate partner or cloud file server over SMB
- Split-tunnel VPN where corporate file servers use public address space
level: high
Known false positives:
- Outlook opening an attachment or link on a legitimate partner/cloud file server reached over SMB
- Split-tunnel VPN or hybrid setups where internal file servers use public IP space
Tuning notes: Allow-list known partner/Azure Files SMB endpoints by DestinationIp. Add your own public ranges that host internal SMB. Add IPv6 ULA/link-local (fc00::/7, fe80::/10) exclusions if IPv6 telemetry is present. Pair with SPL-001 hits by pulling the .msg file opened (see KQL-001) and resetting the affected user's password since the NTLMv2 hash must be treated as exposed.
- Outlook Launched on Message File from User-Writable Path - CVE-2026-124194 Delivery (Exploitation) · unlock with TL Creds
- Overpass/Pass-the-Hash Logon via seclogo (Mimikatz sekurlsa::pth) - Leaked Hash Reuse (Post-Exploitation) · unlock with TL Creds
- Exchange Worker Process Spawning Shell - CVE-2026-118207 Exploitation (RCE / Lateral Movement) · unlock with TL Creds
- Any Endpoint Process Making Outbound SMB to Internet - Forced NTLM Authentication (Exploitation) · unlock with TL Creds
- NTLMv2 Hash Cracking and NTLM Relay Tooling Execution (Post-Exploitation) · unlock with TL Creds
- LSASS Spawning Command Interpreter - LDAP/Schannel/AD DS RCE Exploitation (RCE / Lateral Movement) · unlock with TL Creds
- NTLM Network Logon with Zero Key Length - Pass-the-Hash / Relayed Hash Use (Post-Exploitation) · unlock with TL Creds
- Windows Search, MSMQ or Print Spooler Service Spawning Shell - Patch Tuesday Nov 2026 RCE/EoP Exploitation · unlock with TL Creds
Indicators of compromise
As of 2026-11-11, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-5711.
Technical analysis
Cisco Talos reports that Microsoft's November 2026 Patch Tuesday addressed 1,095 vulnerabilities, 64 rated Critical by Microsoft (48 of them remote code execution). Other trackers quote slightly different totals (Rapid7 1,092, CyberScoop ~1,090, NTCompatible/PureInfotech 1,094, SecurityOnline 1,093), so the exact count depends on how third-party CVEs are counted. Only one flaw is flagged by Microsoft as exploited in the wild and none were publicly disclosed before release.
The exploited flaw, CVE-2026-124194, is a Microsoft Outlook spoofing vulnerability (CWE-356, product UI does not warn users of unsafe actions; CVSS 6.5, exploit code maturity High). An unauthenticated attacker sends a crafted message file and persuades the user to open it. Outlook then silently connects to an attacker-controlled network location without the usual external-content warning and leaks the user's NTLMv2 hash, which can be relayed or cracked offline. The Preview Pane is not an attack vector. Microsoft has published no campaign details, attribution or IOCs. CISA added it to KEV on 10 Nov 2026 with a federal remediation deadline of 24 Nov 2026. Fixed builds: Microsoft 365 Apps 16.0.14334.21048 / 16.0.17932.21140, Office LTSC 2021 16.0.14334.21048+, Office LTSC 2024 16.0.17932.21140+. The report credits Benoit Sevens (working with Anthropic's Claude) and a researcher known as nono.
Highest-severity items listed by Talos: CVE-2026-109469 Entra Device Registration elevation of privilege (CVSS 10.0, authorization bypass via user-controlled key); CVE-2026-119990 Azure OpenAI EoP (9.8, missing authentication for a critical function); CVE-2026-114160 Azure Managed Grafana EoP via SSRF (9.8); and 9.8 network RCEs in Windows Search (CVE-2026-116928, out-of-bounds write), Windows LDAP (CVE-2026-119958, out-of-bounds write) and Xbox Live Networking Service (CVE-2026-112967, heap overflow). Rapid7 adds further 9.x items including Windows DNS (CVE-2026-88218) and DHCP Server (CVE-2026-88243) RCEs, Azure DevOps Server RCE (CVE-2026-109467, 9.9) and Visual Studio Code RCE (CVE-2026-120779, 9.6). Rapid7 describes CVE-2026-116928 as pre-authentication RCE triggered by a malicious email attachment processed by Exchange and Windows Search.
Microsoft rates exploitation 'More Likely' for Windows NAT RCE (CVE-2026-113862), AD DS RCE and EoP (CVE-2026-118146, CVE-2026-118148), Exchange Server RCE (CVE-2026-118207) and Windows Schannel RCE (CVE-2026-119952, timing discrepancy), plus 37 Important-rated flaws flagged by Talos (mostly Windows kernel, graphics, installer, print spooler and other local EoP bugs). Large clusters of Excel, Word, Outlook, Hyper-V and Message Queuing (MSMQ) memory-corruption bugs are rated 'Less Likely'. Talos released Snort 2 (34 rules) and Snort 3 (18 rules) coverage. No threat actor, malware family or network IOCs are stated in any source; no BeaconBeagle correlation applies because no IPs or domains are published.
MITRE ATT&CK techniques by tactic:
Credential Access
T1110.002 Brute Force: Password Cracking; T1187 Forced Authentication; T1212 Exploitation for Credential Access; T1557 Adversary-in-the-Middle
Initial Access
T1190 Exploit Public-Facing Application; T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment
Execution
T1203 Exploitation for Client Execution; T1204 User Execution; T1204.002 User Execution: Malicious File
Lateral Movement
T1550.002 Use Alternate Authentication Material: Pass the Hash
Remediation
Patches
- Microsoft November 2026 cumulative and Office security updates (see aka.ms/OfficeSecurityReleases and the MSRC Security Update Guide)
Immediate actions
- Deploy the November 2026 Microsoft security updates, prioritising CVE-2026-124194 (Outlook/Office) before the CISA KEV deadline of 2026-11-24
- Confirm Microsoft 365 Apps update channels picked up builds 16.0.14334.21048 / 16.0.17932.21140 or later
- Block outbound SMB (TCP 445) and NTLM authentication to the internet at the perimeter
- Prioritise internet-facing and domain-critical systems for pre-auth RCEs: Windows Search/Exchange (CVE-2026-116928), LDAP (CVE-2026-119958), Schannel (CVE-2026-119952), Exchange (CVE-2026-118207), AD DS (CVE-2026-118146)
- Update Snort 2 / Snort 3 rulesets or Cisco Secure Firewall SRU to pick up Talos coverage
Workarounds
- Outlook Preview Pane is not an attack vector for CVE-2026-124194; restrict opening of untrusted message files until patched
- Block outbound NTLM/SMB to external destinations
Longer-term hardening
- Enforce SMB signing and LDAP signing, enable Extended Protection for Authentication on Exchange and AD CS
- Plan retirement of NTLM where feasible
- Run Exchange Subscription Edition; earlier Exchange versions are out of support
- Train users not to open unexpected Outlook message files
Affected and fixed versions
- Microsoft — Microsoft Office Outlook
Vulnerable versions: Microsoft 365 Apps for Enterprise prior to 16.0.14334.21048 / 16.0.17932.21140; Office LTSC 2021 prior to 16.0.14334.21048; Office LTSC 2024 prior to 16.0.17932.21140
Fixed in: 16.0.14334.21048 and later; 16.0.17932.21140 and later - Microsoft — Microsoft Office (Word, Excel, PowerPoint)
Vulnerable versions: Supported versions before the November 2026 updates
Fixed in: November 2026 Office security updates - Microsoft — Windows (Search, LDAP, Schannel, NAT, MSMQ, Print Spooler, Hyper-V, SMB, TCP/IP, Kernel, Graphics Kernel, Installer, RPC, IIS, HTTP.sys, DNS, DHCP Server)
Vulnerable versions: Supported Windows client and server releases before the November 2026 updates
Fixed in: November 2026 Windows cumulative updates - Microsoft — Exchange Server (Subscription Edition)
Vulnerable versions: Before November 2026 updates
Fixed in: November 2026 updates; earlier Exchange versions are out of support - Microsoft — Active Directory Domain Services
Vulnerable versions: Before November 2026 updates
Fixed in: November 2026 updates - Microsoft — Entra Device Registration, Azure OpenAI, Azure Managed Grafana, Azure DevOps Server, Microsoft Defender, Visual Studio Code
Vulnerable versions: Before vendor November 2026 fixes
Fixed in: Per MSRC advisories
Timeline
Last updated · revalidated 1× · latest source
- Office fixes ship in Microsoft 365 Apps builds 16.0.14334.21048 / 16.0.17932.21140 and Office LTSC 2021/2024 equivalents.
- Cisco Talos publishes its Patch Tuesday summary (1,095 vulnerabilities, 64 critical, 48 RCE) and releases Snort 2 (34 rules) and Snort 3 (18 rules) coverage.
- CISA adds CVE-2026-124194 to the Known Exploited Vulnerabilities catalog.
- Microsoft releases November 2026 Patch Tuesday updates; one vulnerability (CVE-2026-124194, Outlook spoofing) flagged as exploited in the wild, none publicly disclosed beforehand.
- Per Rapid7: .NET 8 LTS release end date, PowerShell 7.4 LTS end date and Windows 11 23H2 Enterprise/Education/IoT end of servicing take effect.
- CISA KEV remediation deadline for US federal agencies to patch CVE-2026-124194.
Update history
- 2026-11-11 — Microsoft November 2026 Patch Tuesday: Exploited Outlook Spoofing Zero-Day (CVE-2026-124194) and 63 Critical Fixes: What changed No severity, exploitability, status or attribution change. New CVEs (2) 2 additional Outlook CVEs, CVE-2026-124227 and CVE-2026-124228, rated Important and not marked exploited. Attribution Unchanged.
Sources cited
- CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-11-10
- Microsoft Patch Tuesday for November 2026 - Cisco Talos Cisco Talos · Vendor report · 2026-11-10
- Patch Tuesday - November 2026 (Rapid7) Rapid7 · Research · 2026-11-11
- Microsoft Security Update Guide (MSRC) Microsoft Security Response Center · Vendor report · 2026-11-10
- Microsoft Outlook Zero-Day CVE-2026-124194 Exploited in the Wild Before November Patch (SecurityOnline) securityonline.info · News · 2026-11-10
- Microsoft November 2026 Patch Tuesday Fixes 1,093 Flaws and an Exploited Outlook Zero-Day (SecurityOnline) securityonline.info · News · 2026-11-10
- Microsoft November 2026 Patch Tuesday Fixes Vulnerabilities, Including Exploited Outlook Zero-Day (Netizen) blog.netizen.net · News · 2026-11-10
- Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday (CyberScoop) cyberscoop.com · News · 2026-11-10
- Microsoft November 2026 Patch Tuesday: 1,094 CVEs, One Exploited (NTCompatible) ntcompatible.com · News · 2026-11-10
Other reports on CVE-2026-124194
Other reports on CVE-2026-109469
Previous and next in vulnerability
Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated .
