Microsoft November Patch Tuesday: one exploited Outlook bug and 30 wormable flaws

Microsoft's November Patch Tuesday revealed a critical actively exploited Outlook spoofing vulnerability (CVE-2026-124194) that leaks NTLMv2 credential hashes, enabling attackers to conduct pass-the-hash attacks and potentially compromise entire networks. Alongside this, 30 wormable flaws—including a zero-click RCE in Windows Search—highlight how unpatched systems can serve as self-propagating entry points across an organization. The scale of 1,090 vulnerabilities in a single cycle underscores that organizations without disciplined, risk-prioritized patch programs are chronically exposed. Delayed patching, especially for zero-day and wormable vulnerabilities, transforms known, fixable weaknesses into active attack opportunities.