Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes

Microsoft released patches for 1,259 vulnerabilities across its software lineup on Tuesday, marking the second consecutive month where the patch count surpassed 1,000. The updates affected 726 Windows issues, 174 Office flaws, 61 Developer Tools problems, 59 SQL Server concerns, 53 other Developer Tools issues, and 27 SharePoint Server concerns.

In addition to the main CVE identifiers, 165 non-Microsoft-issued vulnerabilities were also addressed. Over 500 of these flaws relate to privilege elevation, followed by remote code execution and information disclosure bugs. Senior staff research engineer at Tenable, Satnam Narang, noted that this update brings Microsoft's total CVE fixes for the year to over 5,100.

Among the critical issues, Microsoft has flagged a Moderate-severity Outlook vulnerability (CVE-2026-124194, CVSS score: 6.5) as actively exploited. The flaw allows an attacker to perform spoofing over a network if a user opens a specially crafted message file. This could lead to the disclosure of authentication information, such as NTLMv2 hashes, which can be used to impersonate the user. Microsoft stated that successful exploitation requires network connectivity and user interaction.

The vulnerability was discovered and reported by researcher Nono and Anthropic's Benoît Sevens. Email security expert Jack Bicer emphasized the potential impact, stating that a stolen hash can open doors beyond the inbox. However, Redmond has not officially attributed the exploitation to a specific threat actor or provided technical details on the current exploitation methods.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to apply the patch by November 24, 2026.

Other noteworthy vulnerabilities fixed in this patch set include remote code execution flaws in Windows Search, Lightweight Directory Access Protocol, Windows Schannel, Windows Virtual Filtering Platform, and Windows Xbox Live Networking Service, as well as a privilege escalation flaw in Azure OpenAI. With the patch volume at a record high, security teams are struggling to prioritize and address these critical issues, according to Jake Knott, head of threat intelligence at watchTowr.

He advised focusing on exposed components, assessing the exploitability of identified vulnerabilities, and closing identity visibility gaps in the security operations center (SOC).