Technology news and discussion on TalkFuse.
Microsoft fixes 1,094 flaws, including exploited Outlook vulnerability
Microsoft’s November security update fixes 1,094 flaws, including an Outlook vulnerability that the company says attackers were already exploiting. The volume marks a second consecutive month with more than 1,000 fixes, adding pressure on security teams and making prioritisation important.
The Outlook flaw, CVE-2026-124194, can expose a user’s NTLMv2 hash when they open a specially crafted message file; attackers may then use the hash to authenticate as that user. Two other critical flaws could allow remote code execution without user interaction: one affects Windows Search in Exchange, and another affects Windows LDAP, potentially putting domain controllers at risk. Microsoft has not disclosed who exploited the Outlook flaw or when attacks began.
In short
- Microsoft fixed 1,094 flaws in its November update.
- Attackers exploited an Outlook flaw that can expose login hashes.
- Two critical zero-click vulnerabilities could enable remote code execution.
Read the full article at the source →
Originally published by The Register as “November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far”.