Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes

An actively exploited vulnerability in Microsoft Outlook (CVE-2026-116928) can leak NTLMv2 hashes, enabling attackers to impersonate legitimate users through pass-the-hash or relay attacks without ever needing a plaintext password. This flaw is one of 1,259 addressed in a single Microsoft patch cycle, underscoring how quickly vulnerability debt accumulates when patching is delayed. CISA's addition of this CVE to its Known Exploited Vulnerabilities catalog signals that real-world exploitation is already underway, meaning unpatched organizations face immediate risk. Prompt patching combined with NTLMv2 hardening controls is essential to prevent credential theft and lateral movement.