Microsoft released November 2026 security updates that include an actively exploited Microsoft Outlook spoofing flaw, CVE-2026-124194, which the company says can disclose authentication information such as NTLMv2 hashes if a user opens a crafted message file^1,2,3.

The three outlets disagree on how many CVEs Microsoft shipped. The Hacker News put the total at 1,259, including 165 identifiers not issued by Microsoft¹. BleepingComputer counted 1,235 flaws on Patch Tuesday itself and said it excluded 108 earlier November fixes, including Edge and Mariner items². The Record cited 1,093 bugs, attributing that figure to a Microsoft security-response post³.

All three reported that CVE-2026-124194 is the only Microsoft bug in this round flagged as exploited in the wild^1,2,3. Microsoft rated it Moderate, with a CVSS score of 6.5^1,3. The company said an unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected Outlook version^1,2,3.

Opening the file could cause Outlook to connect to an attacker-controlled network location without the usual external-content warning, Microsoft said, potentially disclosing authentication information that could be used to impersonate the user^2,3. Exploitation requires network connectivity and user interaction, the company said^1,2.

The U.S. Cybersecurity and Infrastructure Security Agency added the Outlook flaw to its Known Exploited Vulnerabilities catalog^1,3. The Hacker News said federal civilian agencies must apply the fix by Nov. 24, 2026¹. The Record said CISA gave agencies until the end of the month³. Microsoft has not named a threat actor or described how the bug is used in attacks¹.

Microsoft credited a researcher named Nono and Anthropic’s Benoît Sevens, using Claude, with reporting the Outlook issue, The Hacker News said¹. The Record said Microsoft wrote that Sevens discovered the bug using Claude³.

BleepingComputer said the Patch Tuesday set includes 66 Critical vulnerabilities, 48 of them remote code execution². The Hacker News said more than 500 of its 1,259 count were elevation of privilege, with Windows, Office, developer tools, SQL Server and SharePoint among the products patched¹. The Record said several experts counted 63 Critical items³.

Tenable’s Satnam Narang said Microsoft has now addressed more than 5,100 CVEs this year, according to The Hacker News, and more than 5,160 according to The Record^1,3. October’s Patch Tuesday also exceeded 1,000 flaws, with BleepingComputer citing 1,411². Microsoft has not said which campaigns used CVE-2026-124194^1,2.