November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far

Microsoft's November Patch Tuesday addressed 1,094 vulnerabilities, including an actively exploited Outlook spoofing flaw (CVE-2026-124194) that allows attackers to steal NTLMv2 hashes simply by tricking users into opening a crafted email message. Despite carrying only a moderate CVSS score, the real-world exploitation of this flaw demonstrates that severity ratings alone should not dictate patching priority. Two additional zero-click critical vulnerabilities in Windows Search and Exchange compound the risk, requiring no user interaction to exploit. Organizations that delay applying Patch Tuesday updates leave themselves exposed to credential theft and potential lateral movement across their networks.