Microsoft's November Patch Tuesday landed yesterday with a CVE count that looks like a typo. Rapid7 counts 1,092 Microsoft vulnerabilities published this month. SOCRadar says 1,094. Either way, that's not a patch cycle, that's a phone book.
Out of all of that, Microsoft says exactly one is being exploited in the wild. And it's not one of the 9.8s. It's a "Moderate" Outlook bug with a CVSS of 6.5.
That's the one I'd look at first.
What We Know
From Microsoft's advisory as summarized by Rapid7, SOCRadar and SMTPedia:
- The bug: CVE-2026-124194, an Outlook "spoofing" vulnerability. The underlying flaw is a missing warning: Outlook reaches out to an attacker-controlled location without showing the external-content prompt it's supposed to.
- What the attacker gets: the user's NTLMv2 hash. Rapid7 notes that hash can be relayed in real time where SMB or LDAP signing and Extended Protection for Authentication aren't enforced, or cracked offline.
- What it takes: the victim has to open a crafted message. Rapid7 and SOCRadar both say the Preview Pane is not an attack vector. So it's not zero-click, but "open an email" is not exactly a high bar.
- Status: exploited in the wild, per Microsoft. Not publicly disclosed before the patch. SOCRadar also reports CISA added it to the Known Exploited Vulnerabilities catalog on November 10.
- The fix ships in Office, not in the Windows cumulative update. Microsoft 365 Apps and Office LTSC need their own update. If your patch report only checks Windows KBs, you could be green and still exposed.
What we don't know: who's using it, against whom, or how widely. Microsoft hasn't said, and I'm not going to guess.
Why a 6.5 Beats a 9.8
CVSS scores the bug. It doesn't score the attacker's plan.
A leaked NTLM hash is a credential. In a network that still allows NTLM relay, one opened email can turn into authenticating as that user somewhere else, maybe somewhere important. Attackers have been running this exact play against Outlook for years because it works. The vulnerability changes every few months. The technique doesn't.
Meanwhile the scary-looking criticals this month (Rapid7 calls out a pre-auth Schannel RCE and a Windows Search RCE triggered through Exchange processing an attachment, and SOCRadar flags an unauthenticated LDAP RCE) aren't known to be exploited yet. Patch those too. Just don't let the big numbers push the one that's actually being used to the bottom of the list.
The Volume Problem
A thousand-plus CVEs in a month is the new normal, and I wrote last week about why: AI is finding bugs faster than anyone can patch them. Nobody's team reads a thousand advisories. You triage on "exploited," "exposed," and "what does it give the attacker." This month, that triage points at Outlook.
I work at Zscaler, so here's my bias out in the open: the reason a hash leak matters so much is that the hash is useful somewhere on a flat network. Outbound SMB to the internet shouldn't exist, and internal services shouldn't accept relayed credentials from wherever. Shrink where a stolen credential works and this whole class of bug gets a lot less interesting.
What To Do
- Update Office, not just Windows. Confirm Microsoft 365 Apps and Office LTSC builds actually moved, including Current Channel and any deferred channels.
- Block outbound TCP 445 at the edge. There's almost no good reason for a workstation to speak SMB to the internet.
- Enforce SMB signing, LDAP signing and EPA so a captured hash can't simply be relayed.
- Put privileged accounts in Protected Users so they don't use NTLM at all.
- Keep working on NTLM retirement. Audit where it's still used, and turn it off where it isn't needed.
- Then work the criticals, starting with anything internet-facing.
Note that SOCRadar calls those network steps general hardening, not a Microsoft workaround. Microsoft's advisory lists the update and no mitigation. The patch is the fix.
Bottom Line
The only bug Microsoft says is under attack this month is a Moderate that leaks a hash when someone opens an email. Patch Outlook, block outbound SMB, and make stolen NTLM hashes worthless on your network. The 9.8s can have the afternoon.