Microsoft has released its November security updates, addressing a total of 1,235 vulnerabilities across its product ecosystem. This release marks the fourth time in 2026 that the company has set a new record for the number of patches issued in a single month, following similar milestones in July, September, and October.
Among the extensive list of fixes is one zero-day vulnerability, CVE-2026-124194, which Microsoft confirms is currently being exploited in the wild. This spoofing flaw resides in Microsoft Outlook and affects Microsoft 365 Apps for Enterprise, as well as Office LTSC 2021 and 2024. The vulnerability allows an attacker to steal NTLMv2 account hashes by sending a specially crafted message file to a target. When a user opens the file, the application initiates a connection to an attacker-controlled network location, bypassing standard security warnings regarding external content.
Security researchers emphasize that while the vulnerability is categorized as moderate in severity, its active exploitation and the ubiquity of Outlook make it a high priority for remediation. Because a stolen NTLMv2 hash can be leveraged to impersonate users and gain unauthorized access to broader network resources, administrators are advised to prioritize deploying this update to all users, particularly those with administrative or high-value accounts.
The broader patch bundle includes 66 vulnerabilities rated as critical, the majority of which are remote code execution flaws. Categorically, the largest share of the 1,235 fixes addresses elevation of privilege issues, totaling 536 CVEs. Remote code execution vulnerabilities account for 296 of the patches, while information disclosure flaws make up 157 of the total.
The software industry saw significant patch activity beyond Microsoft this month, with SAP also releasing its largest set of security updates to date. The November SAP Patch Day addressed 43 vulnerabilities, a volume roughly double the company's 2026 monthly average. This release included 12 updates classified as Hot News, the highest priority ranking for SAP security notes, and 13 high-priority items.
Four of the SAP vulnerabilities were assigned a maximum CVSS score of 10.0. These include CVE-2026-89103, a broken access control issue in SAP Gateway identified as ProxyGate, and CVE-2026-120017, which involves a missing authentication flaw in the SAML2 service provider for SAP NetWeaver AS ABAP and the ABAP Platform. Additionally, two memory corruption vulnerabilities were addressed: CVE-2026-76964 in the SAP NetWeaver AS ABAP Internet Communication Manager and CVE-2026-89126 in SAP Web Dispatcher.
