Microsoft released patches for 1,259 vulnerabilities across its software on Tuesday, the second month in a row that its patch count has topped 1,000. The fixes cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools and 27 in SharePoint Server, plus 165 CVE identifiers issued outside Microsoft. More than 500 of the flaws involve elevation of privilege, with remote code execution and information disclosure close behind. According to Tenable senior staff research engineer Satnam Narang, the company has now addressed over 5,100 CVEs this year alone.
Among the patches is a Moderate-severity Outlook flaw (CVE-2026-124194, CVSS 6.5) that Microsoft says is already being exploited. The advisory explains that Outlook's interface fails to warn users about unsafe actions, letting an unauthenticated attacker carry out spoofing over a network by sending a crafted message file and convincing a target to open it. Outlook could then connect to an attacker-controlled location without showing the usual external-content warning, possibly exposing authentication data such as an NTLMv2 hash that could be used to impersonate the user. Exploitation requires network connectivity and user interaction. Microsoft credited researcher Nono and Anthropic's Benoît Sevens, using Claude, with reporting the bug.
Jack Bicer, director of vulnerability research at Action1, said email is the easiest way into any company and this flaw turns one opened file into a stolen identity, adding that a captured hash can let an attacker sign in as the victim and move to other systems. He argued the Moderate label undersells the issue because it is already being exploited, needs a single click and affects Outlook, which nearly every organization runs.
Microsoft has not tied the activity to a specific threat actor or detailed how the flaw is exploited in the wild, and the advisory does not say whether discovery came before or after exploitation began. CISA added the flaw to its Known Exploited Vulnerabilities catalog, with federal agencies required to patch by November 24, 2026.
Other notable fixes include remote code execution flaws in Windows Search (CVE-2026-116928), LDAP (CVE-2026-119958), Windows Schannel (CVE-2026-119952), the Windows Virtual Filtering Platform (CVE-2026-95962) and the Windows Xbox Live Networking Service (CVE-2026-112967), plus a privilege escalation flaw in Azure OpenAI (CVE-2026-119990). Jake Knott, head of threat intelligence at watchTowr, said security teams are still recovering from the previous month of critical vulnerabilities and emergency patches, and are struggling to work out what actually matters. He advised starting with internet-exposed assets, then flaws already exploited in the wild, and checking whether the vulnerable component is even in use before panicking.
Source: The Hackers News