[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faG0kYs0G2NsXB35rlD4wKsyfXL7yY5I79ACDGyIqcoM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"4d2f2792-7946-4a1c-81d9-6cc4960fb0cf","november-patch-tuesday-wormable-flaws-and-actively-exploited-outlook-bug-demand-urgent-action","9ba3beda-47d4-430b-abe0-e539147434f2","November Patch Tuesday: Wormable Flaws and Actively Exploited Outlook Bug Demand Urgent Action","Microsoft's November Patch Tuesday revealed a critical actively exploited Outlook spoofing vulnerability (CVE-2026-124194) that leaks NTLMv2 credential hashes, enabling attackers to conduct pass-the-hash attacks and potentially compromise entire networks. Alongside this, 30 wormable flaws—including a zero-click RCE in Windows Search—highlight how unpatched systems can serve as self-propagating entry points across an organization. The scale of 1,090 vulnerabilities in a single cycle underscores that organizations without disciplined, risk-prioritized patch programs are chronically exposed. Delayed patching, especially for zero-day and wormable vulnerabilities, transforms known, fixable weaknesses into active attack opportunities.","**Immediate actions:**\n- Apply the November Patch Tuesday updates immediately, prioritizing CVE-2026-124194 (Outlook), CVE-2026-116928 (Windows Search), and CVE-2026-119958 (LDAP) across all affected systems.\n- Block outbound NTLM authentication at the network perimeter and enforce SMB signing to reduce NTLMv2 hash relay risk until patching is complete.\n- Run an authenticated vulnerability scan across all Windows endpoints to confirm patch deployment status and identify unprotected assets.\n\n**Long-term improvements:**\n- Establish a risk-tiered patch management policy that mandates emergency patching SLAs (e.g., 24–72 hours) for actively exploited or wormable vulnerabilities.\n- Maintain a continuously updated software and asset inventory so patch coverage can be verified against every in-scope system automatically.\n- Implement network segmentation to limit lateral movement potential from wormable vulnerabilities, isolating critical services like LDAP and Windows Search.\n\n**Detection measures:**\n- Deploy honeypot accounts and monitor for NTLMv2 hash capture or relay attempts, which may indicate active exploitation of the Outlook spoofing bug.\n- Alert on anomalous Windows Search or LDAP traffic patterns that could indicate worm-like propagation across internal segments.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-02: Incident Mitigation","NIS2 Article 21(2)(e)","MITRE ATT&CK T1557: Adversary-in-the-Middle",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"NIST CSF 2.0 RS.MI-02: Incident Mitigation":20,"MITRE ATT&CK T1557: Adversary-in-the-Middle":21,"CIS Control 7: Continuous Vulnerability Management (v8)":22},"NIS2 Article 21(2)(e) explicitly covers vulnerability handling and disclosure in acquisition and maintenance, requiring entities to have processes to address vulnerabilities like these in a timely manner.","SI-2 mandates identifying, reporting, and correcting system flaws within organizationally defined time frames, which is exactly what timely application of these Patch Tuesday fixes represents.","The active exploitation of CVE-2026-124194 means affected organizations must treat patching as an incident mitigation action to stop ongoing credential hash leakage.","The Outlook NTLMv2 hash leakage bug enables credential capture and relay attacks, which map directly to this ATT&CK technique used to intercept and abuse authentication material.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; a prioritized patching process for the 30 wormable flaws and the actively exploited Outlook bug directly fulfills this control.","published","2026-11-11T10:21:23.147223+00:00","2026-11-11T10:21:23.124+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fsecurityaffairs.com\u002F202839\u002Fhacking\u002Fmicrosoft-november-patch-tuesday-one-exploited-outlook-bug-and-30-wormable-flaws.html","microsoft-november-patch-tuesday-one-exploited-outlook-bug-and-30-wormable-flaws-6d2e43","Microsoft November Patch Tuesday: one exploited Outlook bug and 30 wormable flaws",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,48,52],{"slug":40,"name":46,"problem":47},"Automated patch management","Known holes get closed in days, not months.",{"slug":49,"name":50,"problem":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":53,"name":54,"problem":55},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]