November 2026 Patch Tuesday: an exploited Outlook flaw

On November 10, 2026, Microsoft released its monthly patches. Only one flaw in the release is marked as exploited: CVE-2026-124194, in Outlook. It is rated Moderate, with a CVSS score of 6.5. Yet CISA added it to its Known Exploited Vulnerabilities (KEV) catalog the same day. The gap between those two signals is what deserves attention this week.

What happened

The exploited flaw. According to Microsoft's advisory, the Outlook user interface does not warn the user of an unsafe action. An unauthenticated attacker sends a crafted message file and convinces the user to open it. Outlook can then connect to an attacker-controlled network location without the usual external-content warning. Microsoft states that this connection discloses the user's NTLMv2 hash, which the attacker can use to authenticate as the user.

A few details in the advisory matter when you assess the risk:

• the Preview Pane is not an attack vector, the file has to be opened;
• the flaw was not publicly disclosed before the patch;
• Microsoft lists it as "Exploitation Detected" and names no threat actor;
• the acknowledgments credit Benoit Sevens of Anthropic and a researcher named "nono".

The KEV listing. The CISA alert of November 10 adds six flaws to the catalog, including the Outlook one. The catalog's JSON feed sets a November 24, 2026 deadline for US federal agencies. The same alert adds a Chromium flaw (CVE-2026-125350), a reminder that browsers need updating this week as well.

The rest of the month. Volume remains very high. The Hacker News counts 1,259 fixed flaws, a second month in a row above 1,000. Microsoft's CVRF document also lists flaws in third-party components such as Chromium and the Linux kernel, so the total varies with how you count. Among the remote code execution flaws rated Critical, three affect widely used Windows services:

None of these three is marked as exploited or publicly disclosed.

Why it matters

The rating does not tell the whole story. A team that sorts patches by CVSS score will put CVE-2026-124194 far behind the 9.8 flaws. Yet it is the only flaw this month that attackers already use. The score describes technical severity; exploitation describes the actual threat. Our approach to prioritizing patches with the KEV catalog rests on that distinction.

Email is still the easiest door. The flaw targets Outlook, so every workstation that opens attachments. The attacker does not need an internet-facing service: one employee opening one file is enough. It is the same logic as the help desk voice phishing campaign: the target is the user, not the firewall.

NTLM is still around. An NTLMv2 hash is only worth something if NTLM is still accepted for authentication somewhere on your network. Many Windows environments still accept it, often without a clear inventory of the applications that depend on it. A flaw that leaks this hash is a reminder that the protocol is a debt, not a detail.

Schannel deserves a high spot in the queue. Schannel handles TLS in Windows. Microsoft rates its exploitation "more likely", which makes it the most serious candidate among this month's unexploited flaws.

What we think at Sentrix

1. Patch Outlook first, despite the Moderate rating. Exploitation is confirmed by Microsoft and by CISA. Workstations used by privileged accounts, executives and finance go first, because their hashes open the most doors.
2. Block outbound SMB and WebDAV to the internet. The leak relies on a connection to an attacker's network location. Microsoft does not name the protocol, but a workstation rarely has any reason to open an SMB session to the outside; a firewall rule that forbids it limits the impact of this flaw and of the next ones built the same way.
3. Inventory NTLM use. List the applications and servers that still require it, then plan their move to Kerberos or modern authentication. Our endpoint and server security service covers this hardening.
4. Put Schannel, LDAP and Windows Search right after. Schannel first, given Microsoft's assessment. Domain controllers, which expose LDAP, are critical assets to patch in the shortest normal window.
5. Update Chromium-based browsers. Chrome, Edge and other browsers built on Chromium are affected by the flaw added to KEV the same day.
6. Keep the evidence. For an audit or an insurer, what counts is the detection date, the fix date and the gap between them. Our vulnerability and patch management service produces that record, month after month. For comparison, see our analysis of the October Patch Tuesday.

The next step

Measure how many of your workstations have the Outlook fix on November 13, then on November 24. If you cannot get that number in a few minutes, the tracking tool is what needs fixing before next month. To review it with us, contact us.