{
  "id": 19429566,
  "title": "November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far",
  "url": "https://urgent.news/2026/11/10/november-patch-tuesday-boasts-over-1-000-bugs-but-only-one-zero-day-19429566",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-10T22:37:01.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/11/10/november-patch-tuesday-boasts-over-1000-bugs-but-only-one-zero-day-so-far/5308946"
  },
  "original_language": "en",
  "account": "Microsoft patched 1,094 bugs during November's Patch Tuesday, but only one zero-day vulnerability has been exploited so far. Security expert Jake Knott of watchTowr suggested that organizations should consider taking a break after dealing with a month of critical vulnerabilities. The single zero-day, CVE-2026-124194, is an Outlook spoofing vulnerability that allows attackers to harvest NTLMv2 hashes to authenticate as users. Microsoft has marked this issue as exploited but has not disclosed when the attacks began or who is behind them. Dustin Childs of TrendAI's Zero Day Initiative warned that the vulnerability is more dangerous than it appears, as attackers can send specially crafted message files convincing users to open them, connecting to attacker-controlled networks without warning users of external content. Despite the high number of CVEs reported this month, only CVE-2026-124194 is currently under active exploitation. Childs emphasized that organizations should not be lulled into a false sense of security, even with back-to-back months of over 1,000 CVEs. He recommended patching Exchange and Domain Controllers first, then prioritizing other critical fixes like CVE-2026-116928 and CVE-2026-119958, which are both zero-click threats with critical CVSS ratings. Additionally, a remote code execution vulnerability in the Xbox Live Networking Service, CVE-2026-112967, has also been patched.",
  "summary": "Microsoft admins wail and gnash their teeth",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Record",
        "title": "Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row",
        "url": "https://urgent.news/2026/11/10/microsofts-patch-tuesday-surpasses-1-000-bugs-for-second-month-in-a",
        "published": "2026-11-10T20:55:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}