---
title: "Microsoft fixed 1094 vulnerabilities in November Patch Tuesday: active zero-day exploit in Outlook and two 9.8-rated zero-click flaws"
description: "In the November Patch Tuesday, Microsoft fixed 1094 vulnerabilities, including an actively exploited zero-day in Outlook (CVE-2026-124194) and two zero-click holes with a 9.8 rating in Windows Search and LDAP. Experts urge immediate installation of updates."
date: 2026-11-11T16:51:44.281Z
lang: en
url: https://xab.info/en/posts/microsoft-patch-tuesday-november-2026-1094-vulnerabilities
tags: [microsoft, patch-tuesday, zero-day, outlook, cve-2026-124194, vulnerability, windows, ldap, exchange, cybersecurity]
author: "Alexander Buran"
publisher: "XAB.info"
---

# Microsoft fixed 1094 vulnerabilities in November Patch Tuesday: active zero-day exploit in Outlook and two 9.8-rated zero-click flaws

![Abstract 3D shapes around the Microsoft Windows logo on a blue background, representing system updates](https://xab.info/media/2026/11/11/microsoft-patch-tuesday-november-2026-1094-vulnerabilities/microsoft-patch-tuesday-november-2026-1094-vulnerabilities-1.webp)

## Key Points

- Microsoft addressed 1094 vulnerabilities in the November 2026 Patch Tuesday
- Zero-day CVE-2026-124194 in Outlook is being actively exploited: NTLMv2 hash leak via malicious file
- Two zero-click vulnerabilities CVE-2026-116928 (Windows Search/Exchange) and CVE-2026-119958 (LDAP) with critical 9.8 rating
- 30 "wormable" vulnerabilities require no user interaction
- Critical RCE vulnerability CVE-2026-112967 in Xbox Live Networking Service (9.8/10)

In the November Patch Tuesday update cycle, Microsoft addressed 1094 vulnerabilities in its products, including one zero-day already being exploited in the wild, two zero-click vulnerabilities with a critical severity rating of 9.8 out of 10, and 30 so-called "wormable" bugs that require no user interaction whatsoever. While the scale of the November package is smaller than October's, which saw 1413 issues fixed, the operational threat level for corporate networks is considered equally severe by experts: active exploitation of a zero-day in Outlook and the potential for remote code execution without a single click make delaying patch installation extremely risky.

### Zero-day in Outlook: NTLMv2 hash leak without standard warnings

The sole zero-day vulnerability in the November package is registered as CVE-2026-124194 and affects the Microsoft Outlook client. Although the formal severity rating is 6.5 out of 10, experts warn that it should not be underestimated. The attack mechanic is as follows: an attacker sends a specially crafted file to the victim and convinces them to open it. Outlook then connects to a network resource controlled by the hacker without displaying the standard warning about downloading external content. This results in the leakage of the user's NTLMv2 hash, which the attacker can use to authenticate to the system on the victim's behalf. Microsoft confirmed that CVE-2026-124194 is already being exploited, though, as is often the case, it did not disclose the start date of the attacks, the identity of the attackers, or the actions taken after gaining access. Specialists remind that once the patch is released, other attackers may begin mass scanning networks for vulnerable versions of Outlook and analyze the fix code to develop their own exploitation methods.

### Two zero-click vulnerabilities with critical 9.8 rating

The current package fixes two zero-click vulnerabilities that do not require any user interaction to trigger an attack. The first, CVE-2026-116928, involves an out-of-bounds write in the Microsoft Windows Search component and threatens remote code execution. An unauthorized attacker can exploit this search feature in Microsoft Exchange by sending an email with a specially crafted attachment. Exchange automatically processes attachments for indexing, so the victim does not need to open the email or the file. Successful exploitation allows the attacker to execute code with the permissions of the service responsible for data processing. The second, CVE-2026-119958, also belongs to the out-of-bounds write class but in the LDAP protocol implementation. It allows remote code execution without any user participation: sending a specially formed LDAP request to a vulnerable system is sufficient, which could lead to domain controller compromise. Both vulnerabilities received a critical rating of 9.8 out of 10.

### "Wormable" threats and a critical hole in Xbox Live

In addition to the zero-click issues, the November list includes 30 "wormable" vulnerabilities, which require neither user interaction nor network activity to exploit—theoretically enabling autonomous propagation of malicious code across infrastructure. A critical vulnerability, CVE-2026-112967, in the Windows Xbox Live Networking Service deserves special attention: it also allows remote code execution, carries a 9.8 out of 10 rating, and requires neither authentication nor user action to exploit. Although the Xbox Live Networking Service is primarily associated with the gaming ecosystem, the presence of a critical RCE vulnerability in the Windows server infrastructure makes it relevant for corporate environments where this service might be active.

### Context: November vs. the record-breaking October

For comparison: in the October 2026 Patch Tuesday, Microsoft fixed a record 1413 vulnerabilities, including three zero-day issues, one of which (CVE-2026-96951, 8.8 CVSS score) was already being used in real-world attacks and was related to bypassing the Mark of the Web mechanism in the Windows Shell. In October, most of the fixes—1102—concerned Windows directly, while 134 were in Office, 61 in developer tools, 36 in SharePoint Server, and 22 in SQL Server; about 70 vulnerabilities were deemed critical. The November package is slightly smaller in total count (1094), but the concentration of actively exploited and zero-click issues makes it equally high-priority for administrators.

### Response recommendations

Experts are unanimous: updates should be installed immediately, especially those regarding Outlook, Windows Search/Exchange, and LDAP components. Corporate security teams are advised to step up monitoring of mailboxes for suspicious attachments, check whether files matching the described CVE-2026-124194 attack scheme were previously received and opened, and audit domain controllers for signs of CVE-2026-119958 exploitation. Users who are unable to install the patch immediately should refrain from opening unsolicited attachments and minimize the time Outlook runs in the background.

## Fact-Check & Sources

- [Microsoft устранила более тысячи уязвимостей в очередном вторничном пакете обновлений](https://3dnews.ru/1151151) - Primary source: 1094 vulnerabilities, CVE-2026-124194 (Outlook, 6.5, actively exploited), CVE-2026-116928 and CVE-2026-119958 (zero-click, 9.8), 30 wormable, CVE-2026-112967 (Xbox Live, 9.8). All data transferred without changes.
- [Microsoft устранила более тысячи уязвимостей в очередном вторничном пакете обновлений](https://3dnews.ru/1151151/microsoft-ustranila-bolee-tisyachi-uyazvimostey-v-ocherednom-vtornichnom-pakete-obnovleniy) - Первоисточник: 1094 уязвимости, CVE-2026-124194 (Outlook, 6.5, активно эксплуатируется), CVE-2026-116928 и CVE-2026-119958 (zero-click, 9.8), 30 червеподобных, CVE-2026-112967 (Xbox Live, 9.8). Все данные перенесены без изменений.
- [Октябрьский «вторник обновлений» Microsoft принес патчи для 1413 уязвимостей](https://xakep.ru/2026/10/16/october-2026-patches/) - Used solely for contextual comparison: October 2026 — 1413 vulnerabilities, 3 zero-days, CVE-2026-96951 (8.8). Does not contradict November data.

## FAQ

### How many vulnerabilities did Microsoft fix in the November 2026 Patch Tuesday?

A total of 1094 vulnerabilities, including one actively exploited zero-day, two zero-click flaws with a 9.8 critical rating, and 30 "wormable" issues.

### What is the zero-day CVE-2026-124194 in Outlook?

It is a vulnerability (6.5/10) where the victim opens a specially prepared file, after which Outlook connects to an attacker-controlled resource without a standard warning, leaking the user's NTLMv2 hash. Microsoft confirmed active exploitation but did not disclose attack details.

### What are zero-click vulnerabilities and why are they dangerous?

Zero-click vulnerabilities require zero interaction from the user. The November package includes CVE-2026-116928 (Windows Search in Exchange—just sending an email with an attachment is enough) and CVE-2026-119958 (LDAP—sending a crafted request is enough). Both have a 9.8 out of 10 rating.

### What should users and administrators do?

Install November updates immediately, increase mail monitoring for suspicious attachments, check domain controllers for signs of the LDAP vulnerability exploit, and if necessary, limit Outlook's background uptime until the patch is applied.