# Microsoft Patch Tuesday November 2026: ~1,095 vulnerabilities, 64 critical, one exploited Outlook NTLM-leak spoofing zero-day (CVE-2026-124194)

> Microsoft's November 2026 Patch Tuesday (10 Nov 2026) fixed roughly 1,095 vulnerabilities per Cisco Talos (other trackers report 1,092-1,094), 64 rated critical and 48 of those RCE. One flaw, CVE-2026-124194 (Outlook spoofing, CVSS 6.5), is exploited in the wild and was added to CISA KEV with a 24 Nov 2026 federal deadline.

- **Published:** 2026-11-11T01:51:20Z
- **Last reviewed:** 2026-11-11T06:44:50.605Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5711
- **ID:** TL-2026-5711
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 5
- **CVEs:** CVE-2026-124194, CVE-2026-109469, CVE-2026-119990, CVE-2026-112967, CVE-2026-114160, CVE-2026-116928, CVE-2026-119958, CVE-2026-113862, CVE-2026-118146, CVE-2026-118148, CVE-2026-118207, CVE-2026-119952, CVE-2026-109459, CVE-2026-119967, CVE-2026-110043, CVE-2026-110068, CVE-2026-111309, CVE-2026-110047, CVE-2026-110067, CVE-2026-111285, CVE-2026-124185, CVE-2026-111289, CVE-2026-120003, CVE-2026-113752, CVE-2026-113753, CVE-2026-113856, CVE-2026-113860, CVE-2026-113861, CVE-2026-113865, CVE-2026-119947, CVE-2026-119960, CVE-2026-113864, CVE-2026-113825, CVE-2026-113859, CVE-2026-114169, CVE-2026-116710, CVE-2026-119963, CVE-2026-119964, CVE-2026-118145, CVE-2026-118292, CVE-2026-118296, CVE-2026-118297, CVE-2026-118701, CVE-2026-118702, CVE-2026-118711, CVE-2026-118713, CVE-2026-118730, CVE-2026-120786, CVE-2026-120788, CVE-2026-120789, CVE-2026-124170, CVE-2026-118737, CVE-2026-119382, CVE-2026-119951, CVE-2026-119957, CVE-2026-119961, CVE-2026-119962, CVE-2026-119966, CVE-2026-125137, CVE-2026-119969, CVE-2026-120005, CVE-2026-122194, CVE-2026-125136, CVE-2026-125134, CVE-2026-113749, CVE-2026-105501, CVE-2026-105524, CVE-2026-109473, CVE-2026-112745, CVE-2026-112759, CVE-2026-112791, CVE-2026-112798, CVE-2026-112811, CVE-2026-112970, CVE-2026-113819, CVE-2026-116714, CVE-2026-119389, CVE-2026-119398, CVE-2026-119818, CVE-2026-119886, CVE-2026-119892, CVE-2026-119903, CVE-2026-119992, CVE-2026-121662, CVE-2026-121663, CVE-2026-122175, CVE-2026-83563, CVE-2026-88230, CVE-2026-88238, CVE-2026-88242, CVE-2026-94514, CVE-2026-95874, CVE-2026-95935, CVE-2026-95963, CVE-2026-95983, CVE-2026-95988, CVE-2026-95989, CVE-2026-96077, CVE-2026-96126, CVE-2026-97013, CVE-2026-119853, CVE-2026-88235, CVE-2026-109467, CVE-2026-120779, CVE-2026-88218, CVE-2026-88243, CVE-2026-124227, CVE-2026-124228

## Description

Cisco Talos reports that Microsoft's November 2026 Patch Tuesday addressed 1,095 vulnerabilities, 64 rated Critical by Microsoft (48 of them remote code execution). Other trackers quote slightly different totals (Rapid7 1,092, CyberScoop ~1,090, NTCompatible/PureInfotech 1,094, SecurityOnline 1,093), so the exact count depends on how third-party CVEs are counted. Only one flaw is flagged by Microsoft as exploited in the wild and none were publicly disclosed before release.

The exploited flaw, CVE-2026-124194, is a Microsoft Outlook spoofing vulnerability (CWE-356, product UI does not warn users of unsafe actions; CVSS 6.5, exploit code maturity High). An unauthenticated attacker sends a crafted message file and persuades the user to open it. Outlook then silently connects to an attacker-controlled network location without the usual external-content warning and leaks the user's NTLMv2 hash, which can be relayed or cracked offline. The Preview Pane is not an attack vector. Microsoft has published no campaign details, attribution or IOCs. CISA added it to KEV on 10 Nov 2026 with a federal remediation deadline of 24 Nov 2026. Fixed builds: Microsoft 365 Apps 16.0.14334.21048 / 16.0.17932.21140, Office LTSC 2021 16.0.14334.21048+, Office LTSC 2024 16.0.17932.21140+. The report credits Benoit Sevens (working with Anthropic's Claude) and a researcher known as nono.

Highest-severity items listed by Talos: CVE-2026-109469 Entra Device Registration elevation of privilege (CVSS 10.0, authorization bypass via user-controlled key); CVE-2026-119990 Azure OpenAI EoP (9.8, missing authentication for a critical function); CVE-2026-114160 Azure Managed Grafana EoP via SSRF (9.8); and 9.8 network RCEs in Windows Search (CVE-2026-116928, out-of-bounds write), Windows LDAP (CVE-2026-119958, out-of-bounds write) and Xbox Live Networking Service (CVE-2026-112967, heap overflow). Rapid7 adds further 9.x items including Windows DNS (CVE-2026-88218) and DHCP Server (CVE-2026-88243) RCEs, Azure DevOps Server RCE (CVE-2026-109467, 9.9) and Visual Studio Code RCE (CVE-2026-120779, 9.6). Rapid7 describes CVE-2026-116928 as pre-authentication RCE triggered by a malicious email attachment processed by Exchange and Windows Search.

Microsoft rates exploitation 'More Likely' for Windows NAT RCE (CVE-2026-113862), AD DS RCE and EoP (CVE-2026-118146, CVE-2026-118148), Exchange Server RCE (CVE-2026-118207) and Windows Schannel RCE (CVE-2026-119952, timing discrepancy), plus 37 Important-rated flaws flagged by Talos (mostly Windows kernel, graphics, installer, print spooler and other local EoP bugs). Large clusters of Excel, Word, Outlook, Hyper-V and Message Queuing (MSMQ) memory-corruption bugs are rated 'Less Likely'. Talos released Snort 2 (34 rules) and Snort 3 (18 rules) coverage. No threat actor, malware family or network IOCs are stated in any source; no BeaconBeagle correlation applies because no IPs or domains are published.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Phishing: Spearphishing Attachment
- T1190 Exploit Public-Facing Application
- T1204 User Execution
- T1204.002 User Execution: Malicious File
- T1203 Exploitation for Client Execution
- T1187 Forced Authentication
- T1557 Adversary-in-the-Middle
- T1110.002 Brute Force: Password Cracking
- T1212 Exploitation for Credential Access
- T1550.002 Use Alternate Authentication Material: Pass the Hash

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Outlook Outbound SMB/NTLM to External Host - CVE-2026-124194 NTLMv2 Leak (Exploitation)** (`TL-2026-5711-SPL-001`)

Detects OUTLOOK.EXE initiating SMB (445/139) connections to a non-private destination, the observable behaviour of CVE-2026-124194 (Outlook spoofing, CWE-356) where opening a crafted message file makes Outlook silently authenticate to an attacker-controlled location and leak the user's NTLMv2 hash. The leaked hash can be relayed (T1557) or cracked offline. Outlook has no legitimate reason to speak SMB to the internet, so any hit warrants triage of the user and the message file opened. CISA KEV deadline 2026-11-24.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1187, T1212, T1566.001, T1204.002
- **Data sources:** sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 3), DeviceNetworkEvents (Microsoft Defender for Endpoint), sigma logsource network_connection/windows
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
```Outlook forced NTLM authentication CVE-2026-124194 (T1187) - OUTLOOK.EXE initiating SMB to a non-RFC1918 host```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 Initiated=true Image="*OUTLOOK.EXE" (DestinationPort=445 OR DestinationPort=139)
| where NOT (cidrmatch("10.0.0.0/8",DestinationIp) OR cidrmatch("172.16.0.0/12",DestinationIp) OR cidrmatch("192.168.0.0/16",DestinationIp) OR cidrmatch("169.254.0.0/16",DestinationIp) OR cidrmatch("127.0.0.0/8",DestinationIp))
| stats count min(_time) as first_seen max(_time) as last_seen values(DestinationPort) as dest_ports by host, User, Image, DestinationIp
| convert ctime(first_seen) ctime(last_seen)
| eval cve="CVE-2026-124194", mitre="T1187,T1212"
````

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemotePort in (445, 139)
| where RemoteIPType == "Public"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, ActionType
| order by Timestamp desc
```

### Sigma

```yaml
title: Outlook Initiating External SMB Connection - CVE-2026-124194 NTLM Leak
id: 7b1f3c52-8d0e-4a6b-9e41-2c5a6f0d8b13
status: experimental
description: Detects OUTLOOK.EXE connecting to a non-private host over SMB (445/139), indicating forced NTLM authentication such as CVE-2026-124194 where a crafted message file leaks the user's NTLMv2 hash.
references:
  - https://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026/
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.credential-access
  - attack.t1187
  - attack.t1212
  - attack.initial-access
  - attack.t1566.001
  - cve.2026.124194
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\outlook.exe'
    Initiated: 'true'
    DestinationPort:
      - 445
      - 139
  filter_private:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '169.254.0.0/16'
      - '127.0.0.0/8'
  condition: selection and not filter_private
falsepositives:
  - Outlook opening a UNC-path attachment hosted on a legitimate partner or cloud file server over SMB
  - Split-tunnel VPN where corporate file servers use public address space
level: high

```

**Known false positives:**

- Outlook opening an attachment or link on a legitimate partner/cloud file server reached over SMB
- Split-tunnel VPN or hybrid setups where internal file servers use public IP space

**Tuning notes:** Allow-list known partner/Azure Files SMB endpoints by DestinationIp. Add your own public ranges that host internal SMB. Add IPv6 ULA/link-local (fc00::/7, fe80::/10) exclusions if IPv6 telemetry is present. Pair with SPL-001 hits by pulling the .msg file opened (see KQL-001) and resetting the affected user's password since the NTLMv2 hash must be treated as exposed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Outlook Launched on Message File from User-Writable Path - CVE-2026-124194 Delivery (Exploitation) (locked: unlock with TL Creds)
- Overpass/Pass-the-Hash Logon via seclogo (Mimikatz sekurlsa::pth) - Leaked Hash Reuse (Post-Exploitation) (locked: unlock with TL Creds)
- Exchange Worker Process Spawning Shell - CVE-2026-118207 Exploitation (RCE / Lateral Movement) (locked: unlock with TL Creds)
- Any Endpoint Process Making Outbound SMB to Internet - Forced NTLM Authentication (Exploitation) (locked: unlock with TL Creds)
- NTLMv2 Hash Cracking and NTLM Relay Tooling Execution (Post-Exploitation) (locked: unlock with TL Creds)
- LSASS Spawning Command Interpreter - LDAP/Schannel/AD DS RCE Exploitation (RCE / Lateral Movement) (locked: unlock with TL Creds)
- NTLM Network Logon with Zero Key Length - Pass-the-Hash / Relayed Hash Use (Post-Exploitation) (locked: unlock with TL Creds)
- Windows Search, MSMQ or Print Spooler Service Spawning Shell - Patch Tuesday Nov 2026 RCE/EoP Exploitation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Microsoft Patch Tuesday for November 2026 - Cisco Talos](https://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026/)
- [Patch Tuesday - November 2026 (Rapid7)](https://www.rapid7.com/blog/post/em-patch-tuesday-november-2026/)
- [Microsoft Outlook Zero-Day CVE-2026-124194 Exploited in the Wild Before November Patch (SecurityOnline)](https://securityonline.info/outlook-zero-day-cve-2026-124194/)
- [Microsoft November 2026 Patch Tuesday Fixes 1,093 Flaws and an Exploited Outlook Zero-Day (SecurityOnline)](https://securityonline.info/november-2026-patch-tuesday/)
- [Microsoft November 2026 Patch Tuesday Fixes Vulnerabilities, Including Exploited Outlook Zero-Day (Netizen)](https://blog.netizen.net/2026/11/10/microsoft-november-2026-patch-tuesday-fixes-1235-vulnerabilities-including-exploited-outlook-zero-day/)
- [Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday (CyberScoop)](https://cyberscoop.com/microsoft-patch-tuesday-november-2026/)
- [Microsoft November 2026 Patch Tuesday: 1,094 CVEs, One Exploited (NTCompatible)](https://www.ntcompatible.com/story/microsoft-november-2026-patch-tuesday-1094-cves-one-exploited-recordbreaking-volume)
- [Microsoft Security Update Guide (MSRC)](https://msrc.microsoft.com/update-guide/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5711