TL;DR

what: Microsoft's November 2026 Patch Tuesday fixed 1,259 vulnerabilities, including CVE-2026-124194, an actively exploited Outlook flaw that suppresses the external-content warning.

impact: One opened message file can make Outlook connect to an attacker-controlled server and hand over the user's NTLMv2 hash, which attackers can use to impersonate that user across the network.

fix: Microsoft's November 2026 security update fixes CVE-2026-124194, and CISA has added it to the KEV catalog with a November 24, 2026 deadline for federal agencies.

who: Any organization running affected Microsoft Outlook versions, which covers nearly every Microsoft 365 and Exchange shop, plus teams exposed to the Windows Search, LDAP, Schannel and Azure OpenAI flaws in the same release.

Microsoft shipped fixes for 1,259 vulnerabilities on November 10, 2026, the second consecutive month that Patch Tuesday has crossed 1,000 CVEs.…