November 2026 Patch Tuesday: Outlook zero-day leaks NTLM hashes

Microsoft's November 2026 Patch Tuesday is out, and the one bug that matters is in Outlook. BleepingComputer counts 1,235 fixes, another record. Only one is confirmed exploited: CVE-2026-124194, an Outlook spoofing flaw that attackers are using to steal Windows login hashes. Microsoft rates it "Moderate." Treat it as the first thing you patch this week.

What actually happened

From Microsoft's own advisory for CVE-2026-124194:

• The attack. An attacker sends a crafted message file and gets someone to open it in Outlook. Outlook then connects to a network location the attacker controls, and it skips the usual external-content warning.
• The damage. That connection leaks the user's NTLMv2 hash. Microsoft says the attacker "could use this to authenticate as the user." Hashes can also be cracked offline.
• The fine print. CVSS 3.1 base score 6.5. No login needed by the attacker, but the user has to open the file. The Preview Pane is not an attack vector. Microsoft's status: "Exploitation Detected."

The rest of the release is volume. BleepingComputer lists 66 critical bugs, 48 of them remote code execution, and notes that its 1,235 total excludes 108 flaws Microsoft fixed earlier in the month. Other trackers report lower totals because they count differently. October's release was 1,411. Microsoft is shipping fixes faster than anyone can read them.

Why it matters for your business

Phishing does not need to install anything anymore. One opened attachment hands over a credential an attacker can replay against your file shares, your VPN or anything else that still accepts NTLM. A "Moderate" label does not change that. The score is low because a person has to click. In a small business, someone always clicks.

Here is the order we would work in:

1. Push the November Office and Windows updates to every PC that runs desktop Outlook. Front desk, sales and accounting first. They open the most mail from strangers.
2. Block outbound SMB (TCP 445) at your firewall. No normal office needs to authenticate to a file share on the open internet. Hash-leak bugs keep returning, and this one rule cuts off the whole class.
3. Tell your staff one thing: an unexpected message file or attachment is a reason to call the sender, not to open it.

Then let the other 1,234 fixes ride your normal update cycle.

Sources: Microsoft Security Response Center, BleepingComputer.