[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fI5ySmvKCE0HINsHJxhaD8hNMr6Da3Jb4ESvUmvLsSsU":3},{"article":4,"iocs":43,"watch_terms":81,"solutions":82,"lesson":175},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"d4eecd0a-2bba-4c80-bbd7-97f0054476c6","Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities, Including Outlook Zero-Day","microsoft-november-2026-patch-tuesday-fixes-1-093-vulnerabilities-including-outl-683151","Microsoft has released its November 2026 Patch Tuesday updates, fixing 1,093 newly released vulnerabilities across Windows, Office, SQL Server, SharePoint, Exchange Server, Azure services, and developer tools. The release includes one actively exploited zero-day in Microsoft Outlook that can leak a user’s NTLMv2 authentication hash to an attacker. This update addresses 63 critical vulnerabilities, 1,029 […] The post Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities, Including Outlook Zero-Day appeared first on Cyber Security News.","Microsoft's November 2026 Patch Tuesday updates address 1,093 vulnerabilities across various products, including an actively exploited zero-day in Microsoft Outlook (CVE-2026-124194). This zero-day, rated Moderate, allows an unauthenticated attacker to leak a user's NTLMv2 authentication hash. The release also includes 63 critical vulnerabilities and 1,029 important issues affecting Windows, Office, SQL Server, Exchange Server, and Azure services.","Microsoft November 2026 Patch Tuesday fixes 1,093 vulnerabilities, including an exploited Outlook zero-day.","https:\u002F\u002Fcybersecuritynews.com\u002Fmicrosoft-november-2026-patch-tuesday\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FMicrosoft-November-2026-Patch-Tuesday-Fixes-1093-Vulnerabilities-Including-Outlook-Zero-Day.webp","2026-11-10T19:01:53+00:00","2026-11-10T20:00:29.204914+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Microsoft Outlook","product",{"name":21,"type":19},"Windows",{"name":23,"type":19},"Office",{"name":25,"type":19},"SQL Server",{"name":27,"type":19},"SharePoint",{"name":29,"type":19},"Exchange Server","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},[44,48,51,53,56,58,60,63,66,69,72,75,78],{"type":45,"value":46,"context":47},"cve","CVE-2026-124194","Actively exploited Microsoft Outlook spoofing vulnerability that can expose a user’s NTLMv2 authentication hash.",{"type":45,"value":49,"context":50},"CVE-2026-124227","Important-rated Outlook code execution issue.",{"type":45,"value":52,"context":50},"CVE-2026-124228",{"type":45,"value":54,"context":55},"CVE-2026-111309","Critical Outlook code execution fix.",{"type":45,"value":57,"context":55},"CVE-2026-110068",{"type":45,"value":59,"context":55},"CVE-2026-110043",{"type":45,"value":61,"context":62},"CVE-2026-113825","Critical flaw in the SMB Server transport driver.",{"type":45,"value":64,"context":65},"CVE-2026-113859","Critical flaw in TCP\u002FIP.",{"type":45,"value":67,"context":68},"CVE-2026-118207","Critical flaw in Exchange Server.",{"type":45,"value":70,"context":71},"CVE-2026-119958","Critical flaw in LDAP.",{"type":45,"value":73,"context":74},"CVE-2026-119990","Critical privilege escalation fix in Azure OpenAI.",{"type":45,"value":76,"context":77},"CVE-2026-114160","Critical privilege escalation fix in Azure Managed Grafana.",{"type":45,"value":79,"context":80},"CVE-2026-122194","Critical code execution fix in Microsoft Defender.",[18,21,25],{"controls":83,"vendors":171},[84,113,142],{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":114,"name":115,"problem":116,"products":117},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":143,"name":144,"problem":145,"products":146},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[147,155,163],{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":164,"vendor_name":165,"vendor_logo":166,"product_slug":167,"product_name":168,"url":169,"description":170},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[172],{"slug":148,"name":149,"logo_path":150,"roles":173},[174],"affected",{"slug":176,"title":177,"body":178,"framework_refs":179,"framework_notes":185},"outlook-zero-day-among-1093-flaws-patched-in-record-patch-tuesday","Outlook Zero-Day Among 1,093 Flaws Patched in Record Patch Tuesday","An actively exploited zero-day in Microsoft Outlook (CVE-2026-124194) allows unauthenticated attackers to steal NTLMv2 authentication hashes, which can then be used in pass-the-hash or relay attacks to compromise accounts and move laterally across networks. The sheer volume of 1,093 vulnerabilities patched in a single cycle—including 63 rated Critical—underscores how rapidly an organization's attack surface can expand if patch cycles are delayed. NTLMv2 hash leakage is particularly dangerous because it can bypass password-based defenses without requiring the plaintext credential. Organizations that fail to prioritize and apply patches promptly, especially for actively exploited zero-days, leave themselves exposed to credential theft and downstream compromise.",[180,181,182,183,184],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-02: Incident Mitigation","NIS2 Article 21(2)(e)","MITRE ATT&CK T1557: Adversary-in-the-Middle",{"NIS2 Article 21(2)(e)":186,"NIST SP 800-53 SI-2: Flaw Remediation":187,"NIST CSF 2.0 RS.MI-02: Incident Mitigation":188,"MITRE ATT&CK T1557: Adversary-in-the-Middle":189,"CIS Control 7: Continuous Vulnerability Management (v8)":190},"This provision requires security in acquisition, development, and maintenance including vulnerability handling, obligating operators of essential services to have processes for rapidly addressing disclosed and exploited vulnerabilities like this Outlook zero-day.","SI-2 requires organizations to identify, report, and correct information system flaws promptly, directly addressing the need to patch CVE-2026-124194 before attackers can exploit the NTLMv2 hash leak.","This category calls for mitigating active incidents, which applies here because CVE-2026-124194 was already being actively exploited at the time of disclosure, requiring immediate containment actions beyond routine patching.","Stealing NTLMv2 hashes via a coercion vulnerability and replaying them in relay attacks is a canonical adversary-in-the-middle technique that this Outlook flaw directly enables.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, including prioritizing actively exploited flaws like this Outlook zero-day within defined SLA windows."]