Newshot Article title: Microsoft Releases Patches for 1,259 Vulnerabilities, Including an Exploited Outlook NTLMv2 Hash Disclosure Flaw
Body:
This round of patches covers 1,259 vulnerabilities, bringing the year's cumulative total to over 5,100
Microsoft released security patches across its entire software lineup on Tuesday, fixing a total of 1,259 vulnerabilities—the second consecutive month in which the patch count exceeded 1,000.
The vulnerabilities break down as follows: 726 in Windows, 174 in Office, 61 in developer tools, 59 in SQL Server, 53 in developer tools, and 27 in SharePoint Server, plus 165 CVEs published by non-Microsoft parties. More than 500 of them are privilege escalation flaws, followed by remote code execution and information disclosure vulnerabilities.
Satnam Narang, senior principal research engineer at Tenable, said that with this round of fixes, Microsoft has patched more than 5,100 CVEs so far this year alone.
Outlook flaw already exploited in the wild, can leak NTLMv2 hashes to impersonate users
Microsoft has flagged a medium-severity security vulnerability in Outlook (CVE-2026-124194, CVSS score 6.5) as being exploited in the wild.
In its security advisory, Microsoft stated: "The product interface of Microsoft Office Outlook does not warn users about unsafe actions, which an unauthorized attacker could exploit to conduct a spoofing attack over the network."
An unauthenticated attacker can send a specially crafted message file and trick the target into opening it in an affected version of Outlook.
When the vulnerability is triggered, Outlook connects directly to a network location controlled by the attacker without displaying the usual external content warning, potentially leaking authentication information such as NTLMv2 hashes, which an attacker can use to impersonate the user.
Microsoft stressed that successful exploitation requires network connectivity conditions and user interaction. The vulnerability was discovered and reported by researcher Nono and Benoît Sevens of Anthropic (who conducted the research with the help of Claude).
Jack Bicer, head of vulnerability research at Action1, said: "Email is the easiest entry point into any enterprise, and this vulnerability lets an attacker steal a user's identity through a single opened file. Once the attacker has the hash, they can directly log in by impersonating the victim. After logging in, the attacker can not only read the victim's stored data but also move laterally to other systems the victim has access to."
The medium-severity rating understates the actual harm of this vulnerability. Attackers are already exploiting it, triggering it requires only a single click by the user on an email file, and it affects Outlook, which nearly every enterprise uses. The stolen hash can open far more than just the inbox door.
However, Microsoft has not yet attributed the related in-the-wild exploitation activity to a specific threat actor, nor has it disclosed technical details of the in-the-wild exploitation. This advisory also does not state whether the vulnerability was discovered before or after attackers began exploiting it.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to complete patching by November 24, 2026.
Several key vulnerabilities warrant simultaneous attention; remediation should proceed in order of priority
Other notable vulnerabilities include several remote code execution flaws affecting Windows Search (CVE-2026-116928), the Lightweight Directory Access Protocol (CVE-2026-119958), Windows Schannel (CVE-2026-119952), the Windows Virtual Filtering Platform (CVE-2026-95962), and Windows Xbox Live network services (CVE-2026-112967), as well as a privilege escalation vulnerability in Azure OpenAI (CVE-2026-119990).
Jake Knott, head of threat intelligence at watchTowr, said: "Most security teams have barely recovered from last month's relentless stream of critical vulnerabilities, emergency patches, and the flood of '2shell'-related incidents, and now they're facing another Patch Tuesday."
With a constant stream of urgent incidents requiring immediate action every day, teams are already exhausted trying to figure out "what actually needs to be prioritized." Remediation should start with internet-facing assets, followed by vulnerabilities already exploited in the wild, and finally everything else.
There's no need to panic the moment you see a patch. Organizations should first confirm whether they use the vulnerable components and whether the preconditions for exploitation are met.
Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes