Microsoft's November Patch Tuesday landed with a number that should make any IT team wince: 1,259 vulnerabilities fixed in a single release, according to The Hacker News. It's the second month in a row the count has topped 1,000 — and the sheer volume is starting to look less like an exception and more like the new normal.

The breakdown tells its own story. Windows accounts for 726 of the fixes, Office for 174, with the rest spread across SQL Server, SharePoint, and developer tools. More than 500 of the flaws are elevation-of-privilege bugs, the kind that let an attacker who already has a foothold climb higher. Tenable's Satnam Narang notes Microsoft has now addressed more than 5,100 CVEs this year alone.

But the flaw that matters most is the one Microsoft rated the least alarming. CVE-2026-124194 is a "Moderate" Outlook spoofing bug, scored 6.5 out of 10 — and Microsoft says attackers are already exploiting it. An unauthenticated attacker sends a specially crafted message file; when the victim opens it, Outlook connects to an attacker-controlled network location without displaying the usual external-content warning. That silent connection can disclose the user's NTLMv2 hash, which an attacker can use to impersonate them. Exploitation requires user interaction and network connectivity, and Microsoft has not attributed the attacks to any particular actor.

"Email is the easiest door into any company, and this flaw turns one opened file into a stolen identity," Jack Bicer, director of vulnerability research at Action1, said. "A captured hash can let an attacker sign in as the victim, read their data, and move to other systems they can reach." He added that the Moderate label undersells the flaw: it needs only one click on an email file, and it hits Outlook, which nearly every organization runs.

The U.S. Cybersecurity and Infrastructure Security Agency has added the bug to its Known Exploited Vulnerabilities catalog, giving federal agencies until November 24 to patch. The rest of the release isn't quiet either: remote code execution flaws in Windows Search, LDAP, Schannel, and the Windows Filtering Platform, plus a privilege escalation bug in Azure OpenAI.

There's an irony buried in the credits, too. Microsoft says the Outlook flaw was discovered and reported by a researcher named Nono and by Anthropic's Benoît Sevens — using Claude. The same class of AI that security teams are racing to defend against is now the one finding the holes.

The deeper problem is the pace. "Most security teams haven't quite recovered from the last month of bumper-to-bumper critical vulnerabilities, emergency patches, and '2shell'-branded everything, and we're yet again at another Patch Tuesday," Jake Knott, head of threat intelligence at watchTowr, said. His advice is triage, not panic: start with what's exposed to the internet, then what's already being exploited in the wild, and only then everything else.

That ordering puts CVE-2026-124194 at the front of the queue — Moderate label or not. The patch is out. The exploit is in the wild. And the fix ships through Office updates, not just the Windows cumulative update, so the one file that matters is the one that's easiest to overlook.

— via The Hacker News