Microsoft has released its November security updates, addressing a total of 1,094 vulnerabilities across its product ecosystem. This marks the second consecutive month in which the company has issued fixes for more than 1,000 bugs, a trend that security researchers attribute to the increased use of automated bug-hunting tools and artificial intelligence in both vulnerability discovery and exploit generation.
Among the massive volume of patches, Microsoft has confirmed that one vulnerability, CVE-2026-124194, is currently being exploited in the wild. This flaw is classified as an Outlook spoofing vulnerability and carries a CVSS score of 6.5. While the severity rating is moderate, experts warn that the real-world impact is significant. By convincing a user to open a specially crafted message file, an attacker can force Outlook to connect to a malicious network location without triggering standard external-content warnings. This process discloses the user’s NTLMv2 hash, which can subsequently be used to authenticate as the victim.
Microsoft has not provided specific details regarding the timeline of these attacks, the identity of the threat actors involved, or the specific objectives of the exploitation. However, the release of the patch is expected to prompt further scrutiny from other malicious actors, who will likely attempt to reverse-engineer the update to develop their own exploits.
Beyond the actively exploited zero-day, the November batch includes two critical vulnerabilities that allow for zero-click remote code execution, both carrying a CVSS score of 9.8. The first, CVE-2026-116928, is an out-of-bounds write vulnerability in the Windows Search Component. It allows an unauthenticated attacker to execute code by sending a specially crafted email attachment to an Exchange server. Because the server automatically indexes the attachment, no user interaction is required for the exploit to succeed.
The second zero-click critical flaw, CVE-2026-119958, involves an out-of-bounds write vulnerability in the Windows implementation of the Lightweight Directory Access Protocol (LDAP). This bug allows an unauthenticated attacker to execute code remotely on a target system, such as a domain controller, by sending specially crafted LDAP requests.
In addition to these, the update addresses a critical heap-overflow vulnerability, CVE-2026-112967, located in the Windows Xbox Live Networking Service. This flaw also carries a 9.8 CVSS score and permits remote code execution without requiring authentication or user interaction, making it a significant concern for any organization running the service on its network.
Security analysts have identified approximately 30 vulnerabilities in this month’s release that carry a wormable risk, as they require neither authentication nor user interaction to exploit over a network. These findings underscore the necessity for organizations to move away from broad, generalized triage processes.
The recommended defensive strategy involves prioritizing patches for Exchange and Domain Controllers to mitigate the risk of zero-click compromises. Furthermore, security teams are advised to ring-fence exposed network services, such as DNS and DHCP, to prevent the potential spread of wormable threats, and to verify the integrity of manual administrative fixes applied to cloud services.
While the current patch cycle contains no other publicly known vulnerabilities, experts emphasize that the high volume of fixes necessitates immediate action. The speed at which patches can now be reverse-engineered means that the threat window for organizations is effectively open the moment updates are released, regardless of whether a bug has been publicly disclosed or exploited prior to the patch.
