Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities, Including Outlook Zero-Day

An actively exploited zero-day in Microsoft Outlook (CVE-2026-124194) allows unauthenticated attackers to steal NTLMv2 authentication hashes, which can then be used in pass-the-hash or relay attacks to compromise accounts and move laterally across networks. The sheer volume of 1,093 vulnerabilities patched in a single cycle—including 63 rated Critical—underscores how rapidly an organization's attack surface can expand if patch cycles are delayed. NTLMv2 hash leakage is particularly dangerous because it can bypass password-based defenses without requiring the plaintext credential. Organizations that fail to prioritize and apply patches promptly, especially for actively exploited zero-days, leave themselves exposed to credential theft and downstream compromise.