[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcxF9MgJazyEMboQtgzAppo46OE4kh8hqzZwW65WTiyY":3},{"article":4,"iocs":48,"watch_terms":71,"solutions":72,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"4e65bb81-858c-457a-b49e-214fca6e26f7","Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes","microsoft-patches-1-259-flaws-including-exploited-outlook-bug-that-may-expose-nt-b4b549","Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers.","Microsoft has released patches for 1,259 vulnerabilities, with over 500 related to elevation of privilege. A moderate-severity flaw in Microsoft Outlook (CVE-2026-116928) is actively exploited and could expose NTLMv2 hashes, allowing an attacker to impersonate a user. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog.","Microsoft patches 1,259 flaws, including an exploited Outlook bug that may expose NTLMv2 hashes.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fmicrosoft-patches-1259-flaws-including.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh_nfFO2Zf-R2XyVzQHP43rc0OLAtUtRKWYV0VIaoHZW8EeH78h2Id9FmfJQVfzFdmBD6ugVGeCehX1Nq6jlmXlMG4AmnV3Tib3YvClKGaplVg5Ngk_KlpqwHx6Pd_oYQTCj2O3HfOpt_MoSGQD-4Nv-pju5sqS7U9-rAJdpKTn-xnhA1QSmmTiQWnAFjGp\u002Fs1600\u002Fpatch-ms.jpg","2026-11-11T08:17:53+00:00","2026-11-11T09:00:25.940952+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Outlook","product",{"name":21,"type":19},"Windows",{"name":23,"type":19},"Office",{"name":25,"type":19},"SQL Server",{"name":27,"type":19},"SharePoint Server",{"name":29,"type":19},"Azure OpenAI","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,56,59,62,65,68],{"type":50,"value":51,"context":52},"cve","CVE-2026-124194","Actively exploited Outlook vulnerability that may expose NTLMv2 hashes.",{"type":50,"value":54,"context":55},"CVE-2026-116928","Remote code execution flaw impacting Windows Search.",{"type":50,"value":57,"context":58},"CVE-2026-119958","Remote code execution flaw impacting Lightweight Directory Access Protocol.",{"type":50,"value":60,"context":61},"CVE-2026-119952","Remote code execution flaw impacting Windows Schannel.",{"type":50,"value":63,"context":64},"CVE-2026-95962","Remote code execution flaw impacting Windows Virtual Filtering Platform.",{"type":50,"value":66,"context":67},"CVE-2026-112967","Remote code execution flaw impacting Windows Xbox Live Networking Service.",{"type":50,"value":69,"context":70},"CVE-2026-119990","Privilege escalation flaw in Azure OpenAI.",[21,25,27],{"controls":73,"vendors":157},[74,103,131],{"slug":75,"name":76,"problem":77,"products":78},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":104,"name":105,"problem":106,"products":107},"patch-management","Automated patch management","Known holes get closed in days, not months.",[108,116,123],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":104,"product_name":120,"url":121,"description":122},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":132,"name":133,"problem":134,"products":135},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[136,144,149],{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":145,"product_name":146,"url":147,"description":148},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[158],{"slug":88,"name":89,"logo_path":90,"roles":159},[160],"affected",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":171},"actively-exploited-outlook-flaw-exposes-ntlmv2-hashes-patch-immediately","Actively Exploited Outlook Flaw Exposes NTLMv2 Hashes — Patch Immediately","An actively exploited vulnerability in Microsoft Outlook (CVE-2026-116928) can leak NTLMv2 hashes, enabling attackers to impersonate legitimate users through pass-the-hash or relay attacks without ever needing a plaintext password. This flaw is one of 1,259 addressed in a single Microsoft patch cycle, underscoring how quickly vulnerability debt accumulates when patching is delayed. CISA's addition of this CVE to its Known Exploited Vulnerabilities catalog signals that real-world exploitation is already underway, meaning unpatched organizations face immediate risk. Prompt patching combined with NTLMv2 hardening controls is essential to prevent credential theft and lateral movement.",[166,167,168,169,170],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.AN-03: Analysis of incidents","NIS2 Article 21(2)(e)","MITRE ATT&CK T1557: Adversary-in-the-Middle",{"NIS2 Article 21(2)(e)":172,"NIST SP 800-53 SI-2: Flaw Remediation":173,"MITRE ATT&CK T1557: Adversary-in-the-Middle":174,"NIST CSF 2.0 RS.AN-03: Analysis of incidents":175,"CIS Control 7: Continuous Vulnerability Management (v8)":176},"This point requires security measures covering vulnerability handling and disclosure in acquisition, development, and maintenance, which includes applying vendor patches promptly for exploited flaws like this Outlook bug.","SI-2 mandates identifying, reporting, and correcting information system flaws within organizationally defined time frames, directly addressing the need to patch CVE-2026-116928 on an emergency basis.","Capturing NTLMv2 hashes via this Outlook vulnerability enables relay and adversary-in-the-middle attacks, the exact technique this ATT&CK entry describes, making credential relay detection critical.","Applying CISA's KEV catalog as an authoritative signal and acting on it represents the kind of threat-intelligence-driven response that this category calls for when known exploitation is confirmed.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, which would have driven timely patching of this actively exploited Outlook flaw before attackers could leverage it."]