[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_a9j54-mH79-zi5fYt0VPa9Bgv-T_RpkAuC6GPyIxTQ":3},{"article":4,"iocs":46,"watch_terms":57,"solutions":58,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"a8451e61-4855-40af-bb30-84285aec742b","November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far","november-patch-tuesday-boasts-over-1-000-bugs-but-only-one-zero-day-so-far-cc35f0","Microsoft admins wail and gnash their teeth","Microsoft's November Patch Tuesday addresses 1,094 vulnerabilities, with CVE-2026-124194, an Outlook spoofing flaw, being the sole actively exploited zero-day. Despite its moderate CVSS score, this vulnerability allows attackers to steal NTLMv2 hashes by tricking users into opening specially crafted messages. The release also includes two critical zero-click threats, CVE-2026-116928 and CVE-2026-119958, impacting Windows Search Component and Exchange.","Microsoft Patch Tuesday fixes 1,094 bugs, including one actively exploited zero-day in Outlook.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F10\u002Fnovember-patch-tuesday-boasts-over-1000-bugs-but-only-one-zero-day-so-far\u002F5308946","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5308965&width=800","2026-11-10T22:37:01+00:00","2026-11-10T23:00:20.110602+00:00",8,[17,20,23,25],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Outlook","product",{"name":24,"type":22},"Exchange",{"name":26,"type":27},"NTLMv2","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,54],{"type":48,"value":49,"context":50},"cve","CVE-2026-124194","Outlook spoofing vulnerability, actively exploited",{"type":48,"value":52,"context":53},"CVE-2026-116928","Zero-click threat in Microsoft Windows Search Component",{"type":48,"value":55,"context":56},"CVE-2026-119958","Zero-click threat impacting Exchange",[18],{"controls":59,"vendors":142},[60,88,116],{"slug":61,"name":62,"problem":63,"products":64},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":82,"vendor_name":18,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":89,"product_name":113,"url":114,"description":115},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":117,"name":118,"problem":119,"products":120},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[121,129,134],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":82,"vendor_name":18,"vendor_logo":83,"product_slug":130,"product_name":131,"url":132,"description":133},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[143],{"slug":82,"name":18,"logo_path":83,"roles":144},[145],"affected",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":156},"outlook-zero-day-among-1094-november-patch-tuesday-fixes-highlights-urgency-of-timely-patching","Outlook Zero-Day Among 1,094 November Patch Tuesday Fixes Highlights Urgency of Timely Patching","Microsoft's November Patch Tuesday addressed 1,094 vulnerabilities, including an actively exploited Outlook spoofing flaw (CVE-2026-124194) that allows attackers to steal NTLMv2 hashes simply by tricking users into opening a crafted email message. Despite carrying only a moderate CVSS score, the real-world exploitation of this flaw demonstrates that severity ratings alone should not dictate patching priority. Two additional zero-click critical vulnerabilities in Windows Search and Exchange compound the risk, requiring no user interaction to exploit. Organizations that delay applying Patch Tuesday updates leave themselves exposed to credential theft and potential lateral movement across their networks.",[151,152,153,154,155],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)","MITRE ATT&CK T1557: Adversary-in-the-Middle",{"NIS2 Article 21(2)(e)":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"MITRE ATT&CK T1557: Adversary-in-the-Middle":159,"CIS Control 7: Continuous Vulnerability Management (v8)":160,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":161},"This point requires security in acquisition, development, and maintenance including vulnerability handling, meaning covered entities must have processes to respond rapidly to disclosures like these Microsoft zero-days.","SI-2 requires identifying, reporting, and correcting system flaws within organizationally defined time frames, which would mandate timely application of patches for CVE-2026-124194 and the two critical zero-click vulnerabilities.","The Outlook spoofing flaw enables NTLMv2 hash capture that adversaries can relay or crack, mapping directly to this technique which describes credential interception via protocol manipulation.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, which directly addresses the need to prioritize and apply the November Patch Tuesday fixes—especially the actively exploited Outlook zero-day—before attackers can steal NTLMv2 credentials.","This category directly covers the need to act on newly disclosed vulnerabilities like those in this Patch Tuesday, ensuring the actively exploited Outlook spoofing flaw is mitigated before widespread credential theft occurs."]