November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far
Microsoft admins wail and gnash their teeth
Microsoft patched 1,094 bugs during November's Patch Tuesday, but only one zero-day vulnerability has been exploited so far. Security expert Jake Knott of watchTowr suggested that organizations should consider taking a break after dealing with a month of critical vulnerabilities. The single zero-day, CVE-2026-124194, is an Outlook spoofing vulnerability that allows attackers to harvest NTLMv2 hashes to authenticate as users.
Microsoft has marked this issue as exploited but has not disclosed when the attacks began or who is behind them. Dustin Childs of TrendAI's Zero Day Initiative warned that the vulnerability is more dangerous than it appears, as attackers can send specially crafted message files convincing users to open them, connecting to attacker-controlled networks without warning users of external content.
Despite the high number of CVEs reported this month, only CVE-2026-124194 is currently under active exploitation. Childs emphasized that organizations should not be lulled into a false sense of security, even with back-to-back months of over 1,000 CVEs. He recommended patching Exchange and Domain Controllers first, then prioritizing other critical fixes like CVE-2026-116928 and CVE-2026-119958, which are both zero-click threats with critical CVSS ratings.
Additionally, a remote code execution vulnerability in the Xbox Live Networking Service, CVE-2026-112967, has also been patched.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
