[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:microsoft-november-2026-patch-tuesday-exploited-outlook-ntlm":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"microsoft-november-2026-patch-tuesday-exploited-outlook-ntlm","rapid-alert","Microsoft November 2026 Patch Tuesday: exploited Outlook NTLM zero-day among 1,093 fixes","Microsoft's November 2026 Patch Tuesday fixes 1,093 CVEs, including CVE-2026-124194, an actively exploited Outlook spoofing flaw that leaks a user's NTLMv2 hash when a crafted file is opened. Patch Outlook first and block outbound NTLM.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fmicrosoft-november-2026-patch-tuesday-exploited-outlook-ntlm-ff3584f4-cover.png","CVE-2026-124194 rapid alert: Still trust an .msg from a stranger? One open leaks your NTLMv2 hash.","Marcus Lenngren","2026-11-10T20:19:01.411+00:00","![CVE-2026-124194 rapid alert: Still trust an .msg from a stranger? One open leaks your NTLMv2 hash.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fmicrosoft-november-2026-patch-tuesday-exploited-outlook-ntlm-ff3584f4-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nMicrosoft shipped its November 2026 Patch Tuesday on 10 Nov. By Microsoft's own count it fixes 1,093 CVEs: 63 critical, 1,029 important and one moderate. Counts differ across trackers because some include Edge and earlier-in-month fixes: BleepingComputer lists 1,235 flaws including Edge, SecurityWeek counts 1,094. The number that matters tonight is one: a single Outlook zero-day that is already being exploited.\n\nThat zero-day is CVE-2026-124194, a Microsoft Outlook spoofing vulnerability with a CVSS score of 6.5, rated Moderate. Despite the low rating, Microsoft confirms it has been exploited in the wild. An unauthenticated attacker sends a specially crafted message file. If a user opens it, Outlook connects to an attacker-controlled network location without the usual external-content warning. That connection discloses the user's NTLMv2 authentication hash, which an attacker can crack offline or relay to impersonate the user.\n\nThe flaw needs user interaction and network connectivity. The Preview Pane is not an attack vector. The discovery was credited to a researcher using the moniker 'nono' and to Benoît Sevens, with the acknowledgement noting use of Anthropic's Claude model.\n\n## Timeline\n\n- Before 10 Nov: CVE-2026-124194 exploited in the wild as a zero-day.\n- 10 Nov: Microsoft releases the fix and confirms attacks have occurred.\n- 10 Nov: Full November release lands, 1,093 CVEs by Microsoft's count.\n\n## Am I affected?\n\nYou are exposed to the exploited zero-day if you run Outlook from any of these, 32-bit or 64-bit:\n\n- Microsoft 365 Apps for Enterprise\n- Office LTSC 2021\n- Office LTSC 2024\n\nBeyond the zero-day, this release carries 48 critical RCE fixes. Notable ones for server and AD admins include CVE-2026-118146 (Active Directory Domain Services RCE, CVSS 8.8, assessed Exploitation More Likely), CVE-2026-118207 (Exchange Server RCE, CVSS 8.8, Exploitation More Likely) and CVE-2026-119952 (Schannel RCE, CVSS 8.1, unauthenticated, Exploitation More Likely). SharePoint Server has an important EoP at CVSS 9.9 (CVE-2026-120002). Excel alone has a dozen critical RCE fixes. Hyper-V has eight critical EoP flaws.\n\nThis is also the final monthly security update for Windows 11 version 23H2 Enterprise and Education editions. Those devices will get no further updates.\n\n## What to do now\n\n1. Patch the exploited Outlook flaw first. Deploy the November updates to M365 Apps, Office LTSC 2021 and Office LTSC 2024 on all user endpoints. Do not wait on the Moderate rating.\n2. Block outbound SMB and NTLM authentication to the internet at the firewall and proxy, so a leaked hash cannot reach an attacker-controlled server.\n3. Patch internet-facing and domain infrastructure next: Active Directory Domain Services (CVE-2026-118146), Exchange (CVE-2026-118207), Schannel (CVE-2026-119952).\n4. Confirm Office build numbers after update to verify the fix actually landed.\n5. Enforce NTLM hardening where possible: SMB signing, and restrict NTLM to remote servers.\n\n## How to hunt\n\n- Look for Outlook sessions followed by outbound SMB or HTTP connections to unfamiliar external IPs or UNC paths.\n- Review security event 4648 (explicit credential use) and NTLM authentication events for unexpected destinations.\n- Search mail gateways and user mailboxes for inbound message files (.msg and similar attachments) that would be opened in Outlook, focused on the period before you patched.\n- Check for any successful authentication from accounts whose users opened such files, from unusual sources.\n\n## What does not help\n\n- Relying on the Preview Pane being safe does not protect you. The user still has to open the file, but once they do, no external-content warning is shown.\n- Treating the Moderate CVSS as low priority is the trap here. Microsoft confirms active exploitation, so exploitation status should drive your order, not the severity label.\n\n## Sources\n\n- [Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities, Including Outlook Zero-Day](https:\u002F\u002Fcybersecuritynews.com\u002Fmicrosoft-november-2026-patch-tuesday\u002F), Cyber Security News, 10 Nov\n- [Microsoft’s November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194)](https:\u002F\u002Fwww.tenable.com\u002Fblog\u002Fmicrosoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194), Tenable Research, 10 Nov\n- [Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fmicrosoft\u002Fmicrosoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day\u002F), BleepingComputer, 10 Nov\n- [Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft](https:\u002F\u002Fwww.securityweek.com\u002Fexploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft\u002F), SecurityWeek, 10 Nov\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"check-point-gaia-under-attack-php2shell-chained-to-root-for","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":44,"kind":6,"title":45,"excerpt":46,"cover_image_url":47,"cover_image_alt":48,"author_name":11,"published_at":49,"reading_minutes":18},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00"]