Quick Answer
Microsoft November 2026 vulnerabilities total 1,259 fixes, and the one to look at first is CVE-2026-124194, a Microsoft Outlook flaw that is already being exploited. The one to look at first is CVE-2026-124194, a Microsoft Outlook flaw that is already being exploited. Opening a crafted message file can make Outlook leak an NTLMv2 hash to an attacker-controlled location. Its CVSS score is only 6.5, but CISA added it to its Known Exploited Vulnerabilities catalogue on 10 November 2026, so review your Outlook installations and re-rank it accordingly.
Introduction
Microsoft has released fixes for 1,259 vulnerabilities this November. If you’re responsible for keeping Windows and Office patched, that should keep you occupied for a while. However, one vulnerability caught our attention in particular. CVE-2026-124194 affects Microsoft Outlook and is already being exploited. It carries a CVSS score of 6.5, which might not immediately send it to the top of your patching list. We would suggest taking a closer look at this one.
Key facts: Microsoft November 2026 vulnerabilities at a glance
- Total fixes: 1,259 CVEs (1,094 Microsoft CVEs plus 165 republished non-Microsoft CVEs).
- Vulnerability: CVE-2026-124194, Microsoft Outlook.
- Severity: CVSS 6.5 (Moderate).
- Exploitation: already being used in attacks.
- CISA KEV: added to the Known Exploited Vulnerabilities catalogue on 10 November 2026.
- What it needs: a user opening a crafted message file, plus network connectivity.
- What can leak: authentication information, including an NTLMv2 hash.
Outlook and an unwanted connection
An attacker convinces someone to open a specially crafted message file in an affected version of Outlook. Opening it can cause Outlook to connect to an attacker-controlled network location without the usual external-content warning. That connection can disclose authentication information, including an NTLMv2 hash.
An NTLMv2 hash isn’t a plain-text password, but captured material could still be useful to an attacker, depending on your configuration and protections.
You wanted to open a message. Outlook decided to make a new friend on the network as well. Unfortunately, the friendship is somewhat one-sided.
The attack requires user interaction and network connectivity, but it has already been used in attacks, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026. Microsoft’s details are in the Security Update Guide, and our Exploit Center tracks actively exploited vulnerabilities.
A severity score only tells you so much
A score of 6.5 can sit below critical findings on a typical list. But if a vulnerability is being actively exploited and the software is used throughout your organisation, its position needs reviewing.
At Rootshell, we recommend considering exploitation activity, affected assets, exposure and business impact alongside severity. We explain the approach in vulnerability prioritisation explained. The score helps, but it doesn’t know your network.
Meanwhile, back on the Exchange server…
Microsoft has also addressed an issue introduced by October’s Windows Server security updates. It affected some on-premises Exchange environments, causing failures signing in to Outlook on the web, emails stuck in the Outbox and issues accessing mailboxes during replication. The cause involved changes to Endpoint Mapper limits, with the impact depending on the server workload.
November’s Windows Server updates include a fix. Administrators should check the update for their server version, review the deployment requirements and test sign-in, mail delivery and mailbox replication afterwards. This is separate from October’s Exchange security updates, and removing those Exchange updates is not recommended.
Where VELMA comes in
VELMA alerts clients through the Rootshell platform where relevant CVEs are present in their environment. Our advice:
- Review your VELMA alerts.
- Prioritise affected Outlook installations.
- Check whether your Exchange environment needs the Windows Server fix.
After deploying, verify the results: confirm the vulnerability is addressed and that services work. A successful installation message is encouraging. Working email and confirmed remediation are rather more useful.
Frequently Asked Questions
What is CVE-2026-124194?
CVE-2026-124194 is a Microsoft Outlook vulnerability that is already being exploited. An attacker convinces someone to open a specially crafted message file. Opening it can make Outlook connect to an attacker-controlled network location without the usual external-content warning, which can disclose authentication information, including an NTLMv2 hash.
Why does a CVSS 6.5 vulnerability need attention?
A score of 6.5 can sit below critical findings, but this flaw is being exploited in attacks and CISA added it to its Known Exploited Vulnerabilities catalogue on 10 November 2026. If Outlook is used across your organisation, its priority needs reviewing. Consider exploitation activity, affected assets, exposure and business impact alongside the severity score.
Does the Outlook flaw need user interaction?
Yes. Someone has to open the crafted message file, and the affected system needs network connectivity. According to Microsoft’s advisory the Preview Pane is not an attack vector, so the risk comes from opening the file itself. The fix is delivered through Microsoft 365 Apps and Office LTSC updates rather than the Windows cumulative update.
Should I remove October’s Exchange updates?
No. Microsoft addressed an issue introduced by October’s Windows Server security updates that affected some on-premises Exchange environments. The fix is in November’s Windows Server updates and is separate from October’s Exchange security updates. Removing those Exchange updates is not recommended. Check the update for your server version, review the deployment requirements, then test sign-in, mail delivery and mailbox replication afterwards.
How does VELMA help with Microsoft patching?
VELMA alerts clients through the Rootshell platform where relevant CVEs are present in their environment. Review VELMA alerts, prioritise affected Outlook installations and check whether your Exchange environment needs the Windows Server fix. After deploying, verify the results: the vulnerability is addressed and services work.
Can’t find the answer to your question?
You can always Contact Our Team of experts for a chat!
