Cybersecurity News
Cybersecurity News Alert: Windows Update Misses the One Flaw
By Nattapong Sukkasem · Published · Updated .
TL;DR — Microsoft shipped its November 2026 security updates on 10 November, closing roughly 1,093 flaws, 63 of them Critical. Exactly one is being exploited: CVE-2026-124194, an Outlook spoofing flaw rated Moderate at CVSS 6.5 and the lowest-severity entry in the entire release. It executes no code. It leaks the victim NTLMv2 hash to an attacker-controlled host when a crafted message file is opened. CISA added it to the known exploited vulnerabilities catalogue the same day, with a 24 November federal deadline. The awkward part for anyone reading a patch dashboard this week is that Windows Update does not deliver the fix. This cybersecurity news cycle turns on an update channel rather than a score.
A fleet that installed every Windows update on Tuesday night is still exposed to the only vulnerability in this month's release that attackers are demonstrably using. That is the uncomfortable shape of this week's cybersecurity news. Microsoft's November 2026 Patch Tuesday is enormous — roughly 1,093 CVEs — and buried near the bottom of the severity table is a single Moderate-rated Outlook bug that is already in use in the wild. Its fix travels on the Microsoft 365 Apps and Office LTSC channels. A Windows patch report will not mention it, will not count it, and will not show a gap where it sits.
What Microsoft shipped on 10 November
The headline number is contested, and it is worth saying so plainly before using it. Tenable, SecurityOnline and GBHackers all count 1,093 CVEs with 63 Critical, 1,029 Important and a single Moderate. The Zero Day Initiative's Dustin Childs writes of “about 1,090” and notes that the overall count is confusing this month. Rapid7 reports 1,092 own-product issues. CrowdStrike publishes 1,252 with 68 Critical. Nobody disputes the shape, only the arithmetic, and nothing below depends on which figure is right.
| CVE | Component | CVSS | Why it matters |
|---|---|---|---|
| CVE-2026-124194 | Microsoft Outlook | 6.5 | The only flaw Microsoft reports as exploited, and the only one rated Moderate |
| CVE-2026-119958 | Windows LDAP | 9.8 | Unauthenticated out-of-bounds write in a service every domain controller runs |
| CVE-2026-116928 | Windows Search | 9.8 | Reached by emailing an attachment to Exchange; nobody has to open it |
| CVE-2026-119952 | Windows Schannel | 8.1 | Labelled Critical and rated more likely to be exploited than the 9.8s |
| CVE-2026-88218 | Windows DNS Server | 9.8 | One of five core network services carrying an unauthenticated 9.8 this month |
| CVE-2026-109469 | Entra device registration | 10.0 | The highest score in the release, reported by a single outlet so far |
The exploited flaw is the smallest one in the release
CVE-2026-124194 is classified as spoofing, scored 6.5, and mapped to CWE-356. An unauthenticated attacker sends a specially crafted message file. The recipient opens it. Outlook then connects to a network location the attacker controls without displaying the external-content warning it would normally show, and the user NTLMv2 authentication hash goes with the connection. Microsoft's own advisory language, as quoted by SecurityOnline, is blunt: the product user interface does not warn the user of unsafe actions.
Two details decide how much this matters. The Preview Pane is not a vector, which Microsoft states explicitly, so the message has to be opened deliberately. And the output is not code execution. It is a credential. Rapid7 notes the hash can be relayed where SMB or LDAP signing and Extended Protection for Authentication are absent, or taken away and cracked offline. Tenable frames the attack as social engineering; Rapid7 says merely opening the file is enough.
Windows Update does not deliver this fix
Here is the operational problem. Rescana, examining the machine-readable advisory data, found that the record for CVE-2026-124194 points to Microsoft's Microsoft 365 Apps security updates page rather than to a Windows cumulative update. WindowsForum put the consequence in one line: Windows Update does not install its fix, you get it through Office's own update channel, and a lot of machines may stay exposed even after Windows shows as fully patched.
That turns a simple question into two questions with different answers. “Are we patched?” asked of the Windows servicing stack returns one number. Asked of the Office Click-to-Run channel it returns another, and the second number is the one that governs the only flaw anyone has been observed exploiting this month. In most estates these are separate pipelines with separate owners, separate maintenance windows and separate reporting. A compliance dashboard that aggregates only the first can be entirely accurate and still wrong about this month's actual exposure. Most cybersecurity news about a release this size is about volume. The useful question here is routing: which pipeline carries which fix, and who checks each one.
There is a second, quieter instance of the same problem in this release. The Windows Search flaw, CVE-2026-116928, is reached through Exchange Server — an attacker emails a crafted attachment, Exchange hands it to the indexer, and code runs with the indexing service permissions without the recipient touching anything. The remedy ships as a Windows update, not an Exchange one. If your Exchange patching runs as its own workstream the server that needs this fix may not appear on the list that gets checked.
A zero-day does not have to be severe to be first
The severity table this month is an argument against reading severity tables alone. Sixty-three Critical entries, 48 of them remote code execution by the Zero Day Initiative's count, and not one of them is known to be under attack. The single Moderate is. A zero-day vulnerability does not have to be the most severe thing in a release to be the most important thing in it, because severity describes what an attacker could achieve while exploitation describes what an attacker chose.
That choice has a detection consequence. A DDoS attack announces itself; the graph moves and the pager fires. A hash disclosure produces no event at all on the victim machine, and its only downstream trace is a successful authentication somewhere later that looks exactly like work. The thing you are hunting is not an anomaly but an ordinary logon with the wrong origin. Cloud security here is a question of release rings rather than servers: Microsoft 365 Apps patch on a cadence you choose, and a deferred channel converts directly into exposure time.
Sixty-three criticals, and the services you cannot switch off
The Critical list is where the server infrastructure risk sits, and it is defined by what is listening rather than by what is installed. Unauthenticated 9.8 flaws landed in LDAP (CVE-2026-119958), DNS (CVE-2026-88218), DHCP (CVE-2026-88243), Kerberos (CVE-2026-85844) and iSCSI (CVE-2026-88234), plus SQL Server (CVE-2026-116945). CrowdStrike makes the point that LDAP listens on TCP 389 and 636 on every domain controller and cannot be disabled without breaking the domain. SharePoint carries a 9.9 at CVE-2026-120002.
Microsoft rates most of these as less likely to be exploited. Schannel, at a lower 8.1, is rated more likely — and the two analyses describe it differently, Tenable as an observable timing discrepancy and Rapid7 as crafted packets under specific conditions. Name neither mechanism with confidence yet. The Windows DNS Server entry is the one to think about hardest if your domain controllers also answer queries, because a resolver you cannot take off the network is a resolver you have to patch in place. If you are reviewing which upstreams those servers forward to, our comparison of public DNS resolvers is a reasonable starting point.
What to do this week
- Reconcile two reports, not one. Produce a list of every endpoint whose Office build is current and a list of every endpoint whose Windows build is current, then compare them. Where the two lists differ, that difference is your IT security exposure for November, and no Windows patch summary will surface it for you.
- Push the Office update deliberately through Intune or Configuration Manager and verify the resulting build number. Do not assume the Click-to-Run channel handled it on its own schedule in time for the 24 November deadline.
- Restrict outbound SMB and NTLM at the egress boundary rather than only hunting for abuse of it. Anything that breaks when you do is an inventory finding you needed anyway.
- Treat LDAP, DNS, DHCP, Kerberos and iSCSI as one change window. They are the same population of servers, they all received unauthenticated remote code execution fixes, and none of them can be firewalled off from the clients that depend on them.
- When a suspicious message file is reported, resolve the external host it references with a network diagnostic tool and record the answer immediately. Attacker-controlled destinations are rotated quickly, and the resolution you did not capture is the one the investigation will ask for.
There is a resolution angle in the Outlook flaw worth drawing out, because it is the only observable the attack generates. Nothing executes on the victim machine; the first machine-visible step is a name lookup for the attacker host, which makes that query the entire early detection surface. DNS over HTTPS decides whether that surface belongs to you or to the application, since a client resolving through an encrypted endpoint of its own produces no record on the resolver you operate. For a credential-disclosure bug whose payload leaves in a single connection, losing the lookup means losing the evidence.
The durable lesson of this cybersecurity news cycle is not about Outlook, and it is not about a score. It is that “fully patched” is not a single fact about a machine. It is a separate fact per update channel, and the channels do not report to each other. This month the one flaw under active attack sits on the channel that most dashboards do not read. Find out how many channels patch your estate, then make each of them answer for itself.
Sources
- Tenable — Microsoft November 2026 Patch Tuesday addresses 1,093 CVEs including CVE-2026-124194
- Zero Day Initiative — The November 2026 security update review
- Rapid7 — Patch Tuesday, November 2026
- Rescana — Microsoft Patch Tuesday November 2026: Windows Search and LDAP remote code execution
- CrowdStrike — November 2026 Patch Tuesday: updates and analysis
- SecurityOnline — Microsoft November 2026 Patch Tuesday fixes 1,093 flaws and an exploited Outlook zero-day
- GBHackers — Microsoft November 2026 Patch Tuesday addresses critical RCE flaws and Outlook zero-day attacks
Related articles
Browse every DNS news article by month →
DNS angle
Review resolver logs for the systems discussed above and compare unexpected names with your approved services. A successful lookup does not establish that a destination is safe. Use the DNS lookup tool to inspect current answers, then compare them with your own resolver and incident records.
Source: Tenable — Microsoft November 2026 Patch Tuesday addresses 1,093 CVEs including CVE-2026-124194 ().