A Moderate Label on the One Flaw Already in Use: Microsoft Fixes Over a Thousand Bugs, and the Exploited One Hides in Outlook

Microsoft November 2026 Patch Tuesday, released November 10, 2026

A Moderate Label on the One Flaw Already in Use: Microsoft Fixes Over a Thousand Bugs, and the Exploited One Hides in Outlook

Threats

Microsoft Security and MSRC CISA NIST and the NIST Cybersecurity Framework (CSF 2.0)MITRE ATT&CK

The second four-figure Patch Tuesday in a row is also a lesson in why the total is the least useful number in it. Counts differ by method and every figure here is attributed: BleepingComputer counts 1,235 flaws released on Patch Tuesday itself, excluding 108 fixed earlier in November, with 66 rated Critical, 48 of them remote code execution; The Register, working from the MSRC guide, counts 1,094; Automox counts 1,093 with 63 Critical. All three agree on the one that matters first. CVE-2026-124194 is an Outlook spoofing flaw, CVSS 6.5 and rated Moderate, that Microsoft confirms is already exploited: a crafted message file, opened by the user, makes Outlook connect to an attacker server without the usual external-content warning and discloses the user NTLMv2 hash, which can be cracked or replayed to impersonate the user. The Preview Pane is not an attack vector for this flaw, and the fix travels through the Office update channel, not Windows Update, with fixed builds 16.0.17932.21140 for Office LTSC 2024 and 16.0.14334.21048 for LTSC 2021. Behind it sit two unauthenticated remote code execution flaws scored 9.8: CVE-2026-116928, an out-of-bounds write in the Windows Search component that Exchange processes automatically when a crafted attachment arrives for indexing, and CVE-2026-119958, an out-of-bounds write in the Windows LDAP implementation reachable on domain controllers. Automox flags two more that severity labels understate: CVE-2026-118207, a Critical Exchange Server remote code execution flaw rated Exploitation More Likely that needs only a low-level login, and CVE-2026-120002, a SharePoint Server flaw scored 9.9 under an Important label, fixed by KB5002945. CISA placed the Outlook flaw in the KEV catalog the same day, with a November 24 federal deadline covered in the next story.

Executives

Do not ask how many patches shipped; ask whether the exploited one is closed. The flaw attackers are using carries a Moderate label and a 6.5 score, and it patches through a different channel than the Windows updates your dashboards watch, so a green Windows report can coexist with an open Outlook hole. Ask for the Office build numbers on endpoints, the Exchange and SharePoint patch state, and the domain controller status, as four separate answers. Two consecutive months above a thousand fixes also means patching capacity is now a standing budget line, not a monthly surprise.

CIO / CISO

Sequence by exploitation and reach, not by label. First the Office update for CVE-2026-124194, verified by installed build, paired with blocking outbound SMB to the internet and hunting for Outlook connections to unfamiliar external hosts. Then the two 9.8 unauthenticated flaws, the Search component path that Exchange indexing exposes and the LDAP flaw on domain controllers, then Exchange CVE-2026-118207 and the SharePoint 9.9, which label-sorted queues will bury. Note the counting spread before briefing upward: 1,235, 1,094 and 1,093 are three methods, not three disagreements about risk.

Engineers

Update Office from inside an Office app or your Office deployment tooling and confirm builds reach 16.0.17932.21140 on LTSC 2024 and 16.0.14334.21048 on LTSC 2021; Windows Update alone leaves the exploited flaw open. Patch domain controllers for the LDAP flaw and Exchange servers for both the Search indexing path and CVE-2026-118207, booking the Exchange restart in the same window. Install KB5002945 on SharePoint Server Subscription Edition farms. Watch endpoint and firewall logs for Outlook-initiated outbound connections, especially over TCP 445.

Everyone (non-IT)

Two updates, not one. Run Windows Update, restart, and then open Outlook or Word, go to File, Account, Update Options, Update Now, because the flaw attackers are already using is fixed through Office, not Windows. Until both are in, do not open unexpected message files or attachments, even from people you know. If work IT announces an Office update push this week, let it run the same day; the Moderate label on this one understates it, because exploited beats severe-but-theoretical every time.