[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_SlUXhX_LclDf8Dp95YAeXw9bT0ZoEi8gr7x-AAJNGo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"096e0bbd-fead-432d-ae0a-8ef5ea16d0c1","record-patch-tuesday-highlights-dangers-of-delayed-patching-and-ntlm-credential-exposure","f8271420-b53d-45c8-aa65-be13d83d5f3b","Record Patch Tuesday Highlights Dangers of Delayed Patching and NTLM Credential Exposure","Microsoft's November 2026 Patch Tuesday addressed a record 1,235 vulnerabilities, including an actively exploited zero-day in Outlook (CVE-2026-124194) that leaks NTLM account hashes simply by opening a crafted message file. The sheer volume of critical patches — 66 rated Critical, 48 enabling Remote Code Execution — illustrates how quickly an unpatched estate becomes an attractive target. NTLM hash disclosure is particularly dangerous because hashes can be relayed or cracked offline to gain unauthorized access to systems and networks. Organizations that lack timely patching processes or treat Patch Tuesday as optional maintenance risk giving attackers a wide-open window between disclosure and remediation.","**Immediate actions:**\n- Apply the November 2026 Patch Tuesday updates immediately, prioritizing CVE-2026-124194 and all 66 Critical-rated vulnerabilities\n- Block or restrict inbound crafted message files at email gateways to reduce Outlook zero-day exposure while patching is underway\n- Enable NTLM relay protections (e.g., SMB signing, Extended Protection for Authentication) to limit hash-capture impact\n\n**Long-term improvements:**\n- Establish a risk-tiered patch SLA policy (e.g., Critical: 24–72 hours, High: 7 days, Medium: 30 days) enforced through automated tooling\n- Maintain a continuously updated asset inventory so every system subject to Microsoft patches is accounted for and tracked to remediation\n- Evaluate phased migration away from NTLM authentication toward Kerberos or modern token-based protocols to eliminate this credential-exposure class\n\n**Detection measures:**\n- Deploy vulnerability scanning on a continuous or at-minimum weekly cadence to identify unpatched systems before attackers do\n- Monitor for NTLM authentication anomalies and unexpected hash-relay attempts in SIEM or EDR tooling as an indicator of active exploitation\n- Subscribe to Microsoft Security Response Center (MSRC) advisories and threat intelligence feeds to receive zero-day exploitation signals in near-real time",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"CIS Control 7: Continuous Vulnerability Management (v8)":20,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":21,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":22},"NIS2 Article 21(2)(e) covers vulnerability handling and disclosure practices, requiring entities to have processes that ensure timely remediation of vulnerabilities such as the actively exploited Outlook zero-day.","SI-2 mandates that organizations identify, report, and correct information system flaws in a timely manner, which would have driven rapid deployment of the Outlook zero-day patch before exploitation could occur.","CIS Control 7 requires establishing a patching and vulnerability remediation process with defined timelines — directly addressing the risk of leaving 1,235 flaws, including an actively exploited zero-day, unpatched.","A.8.8 requires organizations to obtain timely information about technical vulnerabilities and take appropriate measures, which would include prioritizing and tracking remediation of Critical-rated and zero-day patches from Patch Tuesday.","This category requires active mitigation of newly disclosed vulnerabilities, directly applicable to the window between Microsoft's patch release and an organization completing deployment of the Outlook fix.","published","2026-11-10T20:22:21.58217+00:00","2026-11-10T20:22:21.567+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fmicrosoft\u002Fmicrosoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day\u002F","microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day-70a133","Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,48,52],{"slug":40,"name":46,"problem":47},"Automated patch management","Known holes get closed in days, not months.",{"slug":49,"name":50,"problem":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":53,"name":54,"problem":55},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]