Microsoft’s November 2026 Patch Tuesday arrived yesterday with 1,235 vulnerabilities — and one of them is already being weaponized against real targets. CVE-2026-124194 is an Outlook spoofing flaw that silently leaks your NTLMv2 hash when you open a malicious file. No warning. No prompt. The patch arrives through Office Update, not Windows Update, which means automated patching pipelines that stop at the OS level have already left you exposed.
The Exploited Zero-Day: CVE-2026-124194
The mechanics are straightforward — which is what makes this dangerous. An attacker sends a specially crafted email attachment. When you open it in Outlook, the application silently connects to an attacker-controlled server without displaying the external content warning users are trained to watch for. Your NTLMv2 hash lands in the attacker’s hands. From there, they can relay it to authenticate as you on other internal systems, or crack it offline to recover your plaintext password.
Microsoft rates the CVSS at 6.5, which dramatically understates the real-world impact. CISA disagreed: they added CVE-2026-124194 to the Known Exploited Vulnerabilities catalog immediately, giving federal agencies until the end of November to patch. If you’re running Outlook anywhere on your infrastructure, treat this as a CVSS 9.
One more detail: this vulnerability was discovered by researcher Benoît Sevens using Anthropic’s Claude AI assistant — the first confirmed case of an AI-assisted researcher being credited for finding an actively exploited Microsoft vulnerability. AI isn’t just generating code now. It’s finding the holes in 20-year-old infrastructure.
What to do: Open any Office application, go to File > Account > Update Options > Update Now. Windows Update alone will not apply this patch.
The LDAP Threat: CVE-2026-119958 (CVSS 9.8)
If the Outlook flaw is the one being exploited today, CVE-2026-119958 is the one to close before someone else figures it out. It’s an unauthenticated remote code execution flaw in Windows LDAP with a CVSS score of 9.8. The attacker sends crafted LDAP packets — no authentication, no user interaction — and executes code on the target.
The problem is structural. Every domain controller exposes LDAP on TCP/389 by default. You cannot disable it without breaking Active Directory. Any machine that’s domain-joined can reach a DC — which means every machine in your domain has a path to this vulnerability. Code execution on a domain controller means full Active Directory compromise. Microsoft rates this as “not currently exploited,” which should be read as “not yet.”
Exchange Gets a Pre-Auth Attack Path: CVE-2026-116928
CVE-2026-116928 is a Windows Search RCE at CVSS 9.8. The attack path goes through your mail server: an attacker emails a crafted attachment to your Exchange server, and Windows Search automatically indexes it on Exchange’s behalf. The indexing process triggers the bug. No user clicks anything. If your Exchange is internet-facing, this is a pre-auth RCE delivered by email.
Microsoft rates exploitation as “Less Likely.” Patch it this week regardless — the attack surface is too broad to wait.
Update VS Code: CVE-2026-121662 (CVSS 8.6)
Developers have their own item on this month’s list. CVE-2026-121662 is a command injection flaw in Visual Studio Code that bypasses Workspace Trust protections. Open a malicious workspace — a compromised repository, a social-engineering attack — and attacker code runs in your context. Microsoft rates this as “Exploitation More Likely.”
The fix: update to VS Code 1.145.3. Check your current version with code --version and update immediately if you’re on 1.145.2 or earlier.
Schannel and Message Queuing
Two more entries worth noting. CVE-2026-119952 is an RCE in Windows Schannel — Microsoft’s TLS stack — exploitable via a timing discrepancy over any TLS-protected endpoint (HTTPS, RDP, and more). CVSS 8.1, rated “Exploitation More Likely.” CVE-2026-119963 and CVE-2026-119964 are double-free RCE flaws in Windows Message Queuing at CVSS 8.1. MSMQ is off by default on most systems; run the command below to check your exposure:
# Check if MSMQ is enabled
Get-WindowsFeature -Name MSMQ* | Select-Object Name, InstallState
# Check VS Code version
code --versionThe 1,235 CVE New Normal
Last month: 1,411 CVEs. This month: 1,235. Neither number represents a fluke. Microsoft’s MDASH AI security scanner — which incorporates Anthropic’s Mythos model alongside internal tooling — is surfacing vulnerabilities that have been hiding in Windows code for years. Zero Day Initiative put it plainly: for most of 2026, AI was building bigger haystacks. This month it found a needle. That trend is accelerating. Plan your patching cadence accordingly.
Patch Priority Order
- CVE-2026-124194 (Outlook) — exploited now; patch via Office Update immediately, not Windows Update
- CVE-2026-119958 (Windows LDAP) — CVSS 9.8; patch all domain controllers this week
- CVE-2026-116928 (Windows Search / Exchange) — CVSS 9.8; patch internet-facing Exchange servers
- CVE-2026-121662 (VS Code) — Exploitation More Likely; update to 1.145.3
- CVE-2026-119952 (Schannel) — CVSS 8.1, Exploitation More Likely; patch all TLS-serving Windows systems
- CVE-2026-119963/119964 (MSMQ) — check if MSMQ is enabled first; patch if running
Full CVE details are in BleepingComputer’s November 2026 Patch Tuesday roundup and Tenable’s full analysis.
