Microsoft patches 1,092 flaws as Outlook bug was hit

Microsoft published 1,092 vulnerabilities across its products in its November Patch Tuesday release. Rapid7 said one of the flaws is known to have been exploited in the wild.

The release includes 1,102 Windows vulnerabilities, according to Adam Barnett, Lead Software Engineer at Rapid7, who said the volume remains unusually high even after recent months of large releases.

Barnett said the only vulnerability Microsoft has identified as exploited this month is CVE-2026-124194, a spoofing flaw affecting classic Outlook. Opening a specially crafted malicious file can cause Outlook to connect silently to an attacker-controlled location and leak a user's NTLM v2 hash, he said.

The issue affects all supported versions of classic Outlook. Barnett said the flaw's CVSS base score of 6.5 does not fully reflect the practical risk, because attackers could use the leaked hash either to impersonate a user against another service or to crack credentials offline.

“Imagine coming home and checking your mailbox to find a postcard. You admire the non-specific image of a tropical beach at sunset, and flip it over to scan the handwriting on the back, which looks vaguely familiar. It's addressed to you, but you can't make out the signature, and the message is short and generic. Is that real handwriting, or has this been printed? Probably marketing material. You put the card in the recycling and, since life is busy, you move on and forget about it. Somehow, you remain entirely unaware that, immediately after reading the postcard, you took out your phone and sent high-resolution images of your front door key to a number you've never contacted before. Is this sketch just some rather questionable science fiction? Yes, hopefully, but what if that non-specific postcard was instead a malicious file in your Outlook inbox?” Barnett said.

He added that the Preview Pane is not a vector for the Outlook flaw, which may limit its impact in practice.

Remote code risks

Rapid7 also highlighted CVE-2026-119952, a pre-authentication remote code execution vulnerability in Windows. Barnett said the flaw allows an attacker to execute code on a target system by sending specially crafted malicious packets.

The vulnerable component is Schannel, Microsoft's implementation of Transport Layer Security. Barnett said that may widen the pool of exposed endpoints, although Microsoft's advisory notes that specific conditions are required for exploitation.

Even so, Barnett said Microsoft's assessment that exploitation is more likely suggests reliable exploit code may be achievable. He also said an attacker may not need an existing foothold on the same subnet in many cases.

Rapid7 also flagged CVE-2026-116928 as notable. Barnett said it could allow pre-authentication remote code execution on an Exchange server through a malicious attachment processed automatically by Windows Search on behalf of Exchange.

The issue stems from the interaction between Exchange on Windows and the Windows Search component. Barnett said the patches apply to Windows rather than Exchange itself, and added that organisations should be running Exchange Subscription Edition because earlier Exchange versions are out of support.

“Could someone take control of your Exchange server by sending a single email? In short: yes. Microsoft offers customers tight integration between various business-critical components. Exchange running on Windows is Microsoft on Microsoft, and the Windows Search component indexes email on behalf of Exchange. An attacker aiming to exploit CVE-2026-116928 relies on this helpful synergy to achieve pre-auth RCE on the server by sending a malicious attachment, which Exchange will process automatically. How's that for low attack complexity?” Barnett said.

Patch volume

Barnett said the scale of Microsoft's monthly patching activity would have seemed implausible only a few months ago. He said this month felt like a slight reprieve, despite the total still exceeding 1,000 vulnerabilities.

He also questioned whether the increase in fixes necessarily leads to stronger security outcomes. In his view, each code change made to remove a known flaw could also introduce fresh weaknesses that researchers or attackers later find.

At the same time, Barnett said there has not been a matching rise in the number of Microsoft vulnerabilities known to be exploited in the wild. He said Microsoft reported no publicly disclosed vulnerabilities in this month's release and identified exploitation for only one flaw.

Lifecycle changes

The update cycle also comes with fewer Microsoft product lifecycle changes than the previous month. Barnett said .NET 8 Long Term Servicing, PowerShell 7.4 LTS, and Windows 11 Enterprise, Education, and IoT editions have moved past their release end dates.

“The jury is still out on whether patching many more vulnerabilities will lead to better security outcomes; every code change to resolve a known vulnerability could easily introduce new hidden treasure for researchers or threat actors to unearth in the future,” Barnett said.