# Microsoft fixes 1,094 flaws, including exploited Outlook vulnerability

- URL: https://talkfuse.com/story/november-patch-tuesday-boasts-over-1000-bugs-but-only-one-zero-day-so-far/
- Published: 2026-11-10T22:37:01+00:00
- Updated: 2026-11-11T01:36:38+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/11/10/november-patch-tuesday-boasts-over-1000-bugs-but-only-one-zero-day-so-far/5308946
- Topics: Software

## Key points

- Microsoft fixed 1,094 flaws in its November update.
- Attackers exploited an Outlook flaw that can expose login hashes.
- Two critical zero-click vulnerabilities could enable remote code execution.

## Summary

Microsoft’s November security update fixes 1,094 flaws, including an Outlook vulnerability that the company says attackers were already exploiting. The volume marks a second consecutive month with more than 1,000 fixes, adding pressure on security teams and making prioritisation important.

The Outlook flaw, CVE-2026-124194, can expose a user’s NTLMv2 hash when they open a specially crafted message file; attackers may then use the hash to authenticate as that user. Two other critical flaws could allow remote code execution without user interaction: one affects Windows Search in Exchange, and another affects Windows LDAP, potentially putting domain controllers at risk. Microsoft has not disclosed who exploited the Outlook flaw or when attacks began.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.