[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjpdscpQDUmmwCArR94gT-8U62M6dqG-LKQiHZ8Cf1mQ":3},{"article":4,"iocs":44,"watch_terms":67,"solutions":68,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"9ba3beda-47d4-430b-abe0-e539147434f2","Microsoft November Patch Tuesday: one exploited Outlook bug and 30 wormable flaws","microsoft-november-patch-tuesday-one-exploited-outlook-bug-and-30-wormable-flaws-6d2e43","Microsoft November Patch Tuesday security updates fix 1,090 flaws, including one exploited Outlook bug and 30 potentially wormable issues. Microsoft November Patch Tuesday addressed about 1,090 new vulnerabilities, which is less than the roughly 1,400 last month. Two months in a row now exceed every previous year from Microsoft, and the overall count is a […]","Microsoft's November Patch Tuesday addressed 1,090 vulnerabilities, a decrease from the previous month. Among these are 30 potentially wormable flaws and one actively exploited Outlook spoofing bug (CVE-2026-124194) that can leak user NTLMv2 hashes. Other notable fixes include a zero-click RCE in Windows Search (CVE-2026-116928) and an out-of-bounds write in Windows LDAP (CVE-2026-119958).","Microsoft November Patch Tuesday fixes 1,090 flaws, including one exploited Outlook bug and 30 wormable issues.","https:\u002F\u002Fsecurityaffairs.com\u002F202839\u002Fhacking\u002Fmicrosoft-november-patch-tuesday-one-exploited-outlook-bug-and-30-wormable-flaws.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2014\u002F12\u002FMicrosoft-Patch-Tuesday-Exchange-server.png","2026-11-11T09:03:48+00:00","2026-11-11T10:00:34.04856+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Outlook","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":19},"Windows",{"name":26,"type":19},"Exchange Server",{"name":28,"type":19},"Azure OpenAI",{"name":30,"type":19},"Xbox","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49,52,55,58,61,64],{"type":46,"value":47,"context":48},"cve","CVE-2026-124194","Exploited Outlook spoofing flaw",{"type":46,"value":50,"context":51},"CVE-2026-116928","Windows Search remote code execution bug",{"type":46,"value":53,"context":54},"CVE-2026-119958","Windows LDAP service out-of-bounds write",{"type":46,"value":56,"context":57},"CVE-2026-119952","Schannel remote code execution flaw",{"type":46,"value":59,"context":60},"CVE-2026-119990","Azure OpenAI elevation of privilege bug",{"type":46,"value":62,"context":63},"CVE-2026-95962","Windows Virtual Filtering Platform use-after-free",{"type":46,"value":65,"context":66},"CVE-2026-112967","Xbox Live Networking Service heap overflow",[21,24,26],{"controls":69,"vendors":153},[70,98,124],{"slug":71,"name":72,"problem":73,"products":74},"patch-management","Automated patch management","Known holes get closed in days, not months.",[75,83,90],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":84,"vendor_name":21,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":99,"name":100,"problem":101,"products":102},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[103,108,116],{"vendor_slug":84,"vendor_name":21,"vendor_logo":85,"product_slug":104,"product_name":105,"url":106,"description":107},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":125,"name":126,"problem":127,"products":128},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",[154],{"slug":84,"name":21,"logo_path":85,"roles":155},[156],"affected",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":167},"november-patch-tuesday-wormable-flaws-and-actively-exploited-outlook-bug-demand-urgent-action","November Patch Tuesday: Wormable Flaws and Actively Exploited Outlook Bug Demand Urgent Action","Microsoft's November Patch Tuesday revealed a critical actively exploited Outlook spoofing vulnerability (CVE-2026-124194) that leaks NTLMv2 credential hashes, enabling attackers to conduct pass-the-hash attacks and potentially compromise entire networks. Alongside this, 30 wormable flaws—including a zero-click RCE in Windows Search—highlight how unpatched systems can serve as self-propagating entry points across an organization. The scale of 1,090 vulnerabilities in a single cycle underscores that organizations without disciplined, risk-prioritized patch programs are chronically exposed. Delayed patching, especially for zero-day and wormable vulnerabilities, transforms known, fixable weaknesses into active attack opportunities.",[162,163,164,165,166],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-02: Incident Mitigation","NIS2 Article 21(2)(e)","MITRE ATT&CK T1557: Adversary-in-the-Middle",{"NIS2 Article 21(2)(e)":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"NIST CSF 2.0 RS.MI-02: Incident Mitigation":170,"MITRE ATT&CK T1557: Adversary-in-the-Middle":171,"CIS Control 7: Continuous Vulnerability Management (v8)":172},"NIS2 Article 21(2)(e) explicitly covers vulnerability handling and disclosure in acquisition and maintenance, requiring entities to have processes to address vulnerabilities like these in a timely manner.","SI-2 mandates identifying, reporting, and correcting system flaws within organizationally defined time frames, which is exactly what timely application of these Patch Tuesday fixes represents.","The active exploitation of CVE-2026-124194 means affected organizations must treat patching as an incident mitigation action to stop ongoing credential hash leakage.","The Outlook NTLMv2 hash leakage bug enables credential capture and relay attacks, which map directly to this ATT&CK technique used to intercept and abuse authentication material.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; a prioritized patching process for the 30 wormable flaws and the actively exploited Outlook bug directly fulfills this control."]