Microsoft fixed 1094 vulnerabilities in November Patch Tuesday: active zero-day exploit in Outlook and two 9.8-rated zero-click flaws

In the November Patch Tuesday update cycle, Microsoft addressed 1094 vulnerabilities in its products, including one zero-day already being exploited in the wild, two zero-click vulnerabilities with a critical severity rating of 9.8 out of 10, and 30 so-called "wormable" bugs that require no user interaction whatsoever. While the scale of the November package is smaller than October's, which saw 1413 issues fixed, the operational threat level for corporate networks is considered equally severe by experts: active exploitation of a zero-day in Outlook and the potential for remote code execution without a single click make delaying patch installation extremely risky.

Zero-day in Outlook: NTLMv2 hash leak without standard warnings

The sole zero-day vulnerability in the November package is registered as CVE-2026-124194 and affects the Microsoft Outlook client. Although the formal severity rating is 6.5 out of 10, experts warn that it should not be underestimated. The attack mechanic is as follows: an attacker sends a specially crafted file to the victim and convinces them to open it. Outlook then connects to a network resource controlled by the hacker without displaying the standard warning about downloading external content. This results in the leakage of the user's NTLMv2 hash, which the attacker can use to authenticate to the system on the victim's behalf. Microsoft confirmed that CVE-2026-124194 is already being exploited, though, as is often the case, it did not disclose the start date of the attacks, the identity of the attackers, or the actions taken after gaining access. Specialists remind that once the patch is released, other attackers may begin mass scanning networks for vulnerable versions of Outlook and analyze the fix code to develop their own exploitation methods.

Two zero-click vulnerabilities with critical 9.8 rating

The current package fixes two zero-click vulnerabilities that do not require any user interaction to trigger an attack. The first, CVE-2026-116928, involves an out-of-bounds write in the Microsoft Windows Search component and threatens remote code execution. An unauthorized attacker can exploit this search feature in Microsoft Exchange by sending an email with a specially crafted attachment. Exchange automatically processes attachments for indexing, so the victim does not need to open the email or the file. Successful exploitation allows the attacker to execute code with the permissions of the service responsible for data processing. The second, CVE-2026-119958, also belongs to the out-of-bounds write class but in the LDAP protocol implementation. It allows remote code execution without any user participation: sending a specially formed LDAP request to a vulnerable system is sufficient, which could lead to domain controller compromise. Both vulnerabilities received a critical rating of 9.8 out of 10.

"Wormable" threats and a critical hole in Xbox Live

In addition to the zero-click issues, the November list includes 30 "wormable" vulnerabilities, which require neither user interaction nor network activity to exploit—theoretically enabling autonomous propagation of malicious code across infrastructure. A critical vulnerability, CVE-2026-112967, in the Windows Xbox Live Networking Service deserves special attention: it also allows remote code execution, carries a 9.8 out of 10 rating, and requires neither authentication nor user action to exploit. Although the Xbox Live Networking Service is primarily associated with the gaming ecosystem, the presence of a critical RCE vulnerability in the Windows server infrastructure makes it relevant for corporate environments where this service might be active.

Context: November vs. the record-breaking October

For comparison: in the October 2026 Patch Tuesday, Microsoft fixed a record 1413 vulnerabilities, including three zero-day issues, one of which (CVE-2026-96951, 8.8 CVSS score) was already being used in real-world attacks and was related to bypassing the Mark of the Web mechanism in the Windows Shell. In October, most of the fixes—1102—concerned Windows directly, while 134 were in Office, 61 in developer tools, 36 in SharePoint Server, and 22 in SQL Server; about 70 vulnerabilities were deemed critical. The November package is slightly smaller in total count (1094), but the concentration of actively exploited and zero-click issues makes it equally high-priority for administrators.

Response recommendations

Experts are unanimous: updates should be installed immediately, especially those regarding Outlook, Windows Search/Exchange, and LDAP components. Corporate security teams are advised to step up monitoring of mailboxes for suspicious attachments, check whether files matching the described CVE-2026-124194 attack scheme were previously received and opened, and audit domain controllers for signs of CVE-2026-119958 exploitation. Users who are unable to install the patch immediately should refrain from opening unsolicited attachments and minimize the time Outlook runs in the background.