{"id":4104,"date":"2026-11-11T08:40:43","date_gmt":"2026-11-11T08:40:43","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=4104"},"modified":"2026-11-11T08:40:43","modified_gmt":"2026-11-11T08:40:43","slug":"microsoft-patches-1259-flaws-including-exploited-outlook-bug-that-may-expose-ntlmv2-hashes","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=4104","title":{"rendered":"Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Nov 11, 2026<\/span><\/span>Vulnerability \/ Windows Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities<\/a> spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws.<\/p>\n

These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers. More than 500 flaws relate to elevation of privilege, followed by remote code execution and information disclosure bugs.<\/p>\n

With the latest round of fixes, Microsoft has addressed over 5,100 CVEs this year alone, according to Satnam Narang, senior staff research engineer at Tenable.<\/p>\n

Of these, a Moderate-severity security flaw in Microsoft Outlook (CVE-2026-124194<\/a>, CVSS score: 6.5) has been flagged as actively exploited by Microsoft. <\/p>\n

\u00abProduct UI does not warn users of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network,\u00bb Microsoft said in an advisory.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

An unauthenticated attacker could send a specially crafted message file and persuade a target to open it in an affected version of Microsoft Outlook.<\/p>\n

<\/p>\n

This, in turn, could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information, such as an NTLMv2 hash, that could be used to impersonate the user.<\/p>\n

Microsoft emphasized that successful exploitation requires network connectivity and user interaction. The tech giant credited a researcher named Nono and Anthropic’s Beno\u00eet Sevens (using Claude) with discovering and reporting the flaw.<\/p>\n

\u00abEmail is the easiest door into any company, and this flaw turns one opened file into a stolen identity,\u00bb Jack Bicer, director of vulnerability research at Action1, said. \u00abA captured hash can let an attacker sign in as the victim, read their data, and move to other systems they can reach.\u00bb<\/p>\n

\u00abThe Moderate label undersells this one. Attackers are already exploiting it, it needs only one click on an email file, and it hits Outlook, which nearly every organization runs. A stolen hash can open doors far beyond the inbox.\u00bb<\/p>\n

That said, Redmond has not attributed the activity to a particular threat actor or provided technical details on how the vulnerability is being exploited in the wild. The advisory also doesn’t spell out whether the discovery came before or after attackers began exploiting the flaw.<\/p>\n

The development has prompted the U.S. U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add<\/a> the flaw to its Known Exploited Vulnerabilities (KEV<\/a>) catalog, requiring federal agencies to apply the fix by November 24, 2026.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Some other vulnerabilities of note include a number of remote code execution flaws impacting Windows Search (CVE-2026-116928<\/a>), Lightweight Directory Access Protocol (CVE-2026-119958<\/a>), Windows Schannel (CVE-2026-119952<\/a>), Windows Virtual Filtering Platform (CVE-2026-95962<\/a>), and Windows Xbox Live Networking Service (CVE-2026-112967<\/a>), as well as a privilege escalation flaw in Azure OpenAI (CVE-2026-119990<\/a>).<\/p>\n

\u00abMost security teams haven’t quite recovered from the last month of bumper-to-bumper critical vulnerabilities, emergency patches, and ‘2shell’-branded everything, and we’re yet again at another Patch Tuesday,\u00bb Jake Knott, head of threat intelligence at watchTowr, said.<\/p>\n

\u00abTeams are really starting to feel the strain of working out ‘what actually matters?’ when there is fire after fire every day demanding immediate attention. Start with what you actually have exposed to the Internet, then what\u2019s already being exploited in the wild, and only then everything else. Before going into panic mode, check whether you even use the vulnerable component, or meet the prerequisites for exploitation.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Nov 11, 2026Vulnerability \/ Windows Security Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume…<\/p>\n","protected":false},"author":1,"featured_media":4105,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[610,128,918,11,1884,584,147,1883,1585,57],"class_list":["post-4104","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-bug","tag-exploited","tag-expose","tag-flaws","tag-hashes","tag-including","tag-microsoft","tag-ntlmv2","tag-outlook","tag-patches"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4104","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4104"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4104\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/4105"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4104"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4104"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4104"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}