Outlook zero-day CVE-2026-124194 and November 2026 Patch Tuesday: what to update first

Publicly disclosed: 10 November 2026

Microsoft's November 2026 Patch Tuesday, released on 10 November, fixes more than 1,000 vulnerabilities — one of the largest releases ever. One of them, in Outlook, was already exploited before the fix. If a user opens a specially crafted Office file, Outlook connects to an attacker's server and sends the user's NTLMv2 password hash, which can then be used to impersonate the user. CISA added it to its exploited catalog the same day.

What to do

1. Update Office/Outlook — the Outlook fix comes through Office updates, not only the Windows cumulative update. Check that Microsoft 365 Apps or Office installations actually received it.
2. Install the Windows updates, starting with domain controllers, Exchange servers and internet-facing systems.
3. Block outgoing SMB (TCP 445) to the internet at the firewall, so leaked NTLM authentication cannot reach attackers' servers.
4. Where possible, add the most sensitive accounts to the Protected Users group and reduce NTLM use in the domain.
5. Warn users about unexpected Office attachments this week.

A “Moderate” score does not mean low risk when attackers are already using the flaw.

Sources: Tenable: November 2026 Patch Tuesday, CISA alert, 10 Nov 2026.

Need help with this? Contact CySec for a free consultation.

All articles