Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second month in a row that patch volume has exceeded 1,000 flaws.
These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools and 27 in SharePoint Server. The fixes also include 165 CVE IDs not issued by Microsoft. More than 500 vulnerabilities are related to privilege escalation, followed by remote code execution and information disclosure bugs.
With the latest round of patches, Microsoft has fixed more than 5,100 CVEs this year alone, according to Satnam Narang, senior research engineer at Tenable.
Among these, a moderate severity security vulnerability in Microsoft Outlook (CVE-2026-124194, CVSS score: 6.5) was reported as actively exploited by Microsoft.
“The product user interface does not alert users of unsafe actions in Microsoft Office Outlook, which allows an unauthorized attacker to impersonate a network,” Microsoft said in an advisory.
An unauthenticated attacker could send a specially crafted message file and persuade a target to open it in an affected version of Microsoft Outlook.
This, in turn, could cause Outlook to connect to an attacker-controlled network location without displaying the usual external content warning, potentially disclosing authentication information, such as an NTLMv2 hash, that could be used to impersonate the user.
Microsoft emphasized that successful exploitation requires network connectivity and user interaction. The tech giant credited a researcher named Nono and Benoît Sevens of Anthropic (using Claude) for discovering and reporting the flaw.
“Email is the easiest entry point for any business, and this flaw turns an open file into a stolen identity,” said Jack Bicer, director of vulnerability research at Action1. “A captured hash can allow an attacker to log in as a victim, read their data, and move to other systems they can reach.”
“The Moderate label is much lower than this. Attackers are already exploiting it; all it takes is one click on an email file and it reaches Outlook, which almost every organization uses. A stolen hash can open doors far beyond the inbox.”
That said, Redmond did not attribute the activity to any particular threat actor or provide technical details on how the vulnerability is being exploited in the wild. The advisory also does not specify whether the discovery occurred before or after the attackers began exploiting the flaw.
This development prompted the USUS Cybersecurity and Infrastructure Security Agency (CISA) to add the flaw to its catalog of known exploited vulnerabilities (KEV), requiring federal agencies to apply the patch by November 24, 2026.
Some other vulnerabilities of note include a number of remote code execution flaws affecting Windows Search (CVE-2026-116928), Lightweight Directory Access Protocol (CVE-2026-119958), Windows Schannel (CVE-2026-119952), Windows Virtual Filtering Platform (CVE-2026-95962), and Windows Xbox Live Networking Service. (CVE-2026-112967), as well as an elevation of privilege vulnerability in Azure OpenAI (CVE-2026-119990).
“Most security teams still haven’t recovered from the last month of critical vulnerabilities, emergency patches, and anything else branded ‘2shell,’ and we’re once again at another Patch Tuesday,” said Jake Knott, head of threat intelligence at watchTowr.
“Teams are really starting to feel the pressure of having to figure out ‘what really matters?’ » when there are fires after fires every day that require immediate attention. Start with what you have actually exposed on the Internet, then what is already exploited in the wild, and only then everything else. Before entering panic mode, check whether you are using the vulnerable component or whether you meet the prerequisites for exploitation.
Gn tech
