November 2026 Patch Tuesday: 63 Critical Microsoft fixes, plus an Outlook zero day that allows theft of hashed credentials

Publisher excerpt From CSO Online

A currently exploited zero-day vulnerability that can let attackers steal hashed Outlook NTLM credentials is among the 1,094 holes Microsoft fixed in its November Patch Tuesday releases. Although rated as only moderate in severity, with a CVSS score of 6.5, Windows administrators need to address CVE-2026-124194 immediately because threat actors are already attacking it. “Don’t let the low score fool you,” said Nick Carroll, cyber incident response manager at Nightwing. Affected products include Microsoft 365 Apps for Enterprise, and Office LTSC 2021 and 2024. However, since the user has to open a malicious Office file to launch the attack, good employee cybersecurity awareness training and an effective email gateway could mitigate this attack until the patch is installed. Opening the malicious file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. The vulnerability discloses a user’s NTLMv2 password hash to the attacker, who may be able to relay it to other systems to sign in as the user, or crack it to recover the password. Microsoft, which has been using its AI model to find thousands of vulnerabilities in its products since the summer, credited an Anthropic researcher using the Claude AI assistant for finding the Outlook vulnerability. That led Satyam Narang, senior staff researcher at Tenable, to comment, “for most of the year, AI has been building bigger haystacks across Patch Tuesday releases, and this appears to be the first time it has found a needle.” Separately, SAP plugged a critical memory corruption vulnerability dubbed ICM2Shell, with a CVSS rating of 10. Discovered by researchers at Onapsis, the vulnerability impacts the way the SAP Kernel handles WebSocket traffic. Onapsis said that a specially crafted sequence of WebSocket messages could either crash a process or allow an attacker to run code remotely. Affected are SAP Internet Communications Manager (ICM), which is inside the kernel, and SAP Web Dispatcher, a reverse proxy many organizations place at the edge of their network. Microsoft patches Of the 1,094 Microsoft vulnerabilities, 63 were rated as critical. Four flaws carry a CVSS severity score of 9.8, noted Jack Bicer, director of vulnerability research at Action1, and three of them need no credentials and no user action to exploit. The Windows LDAP Remote Code Execution Vulnerability (CVE-2026-119958) lets an unauthenticated attacker run code inside the Windows LDAP service, which puts domain controllers and the whole Active Directory environment at risk. The Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2026-118207) can be triggered by anyone able to send email to the organization, Bicer said, and the Windows Xbox Live Networking Service Remote Code Execution Vulnerability (CVE-2026-112967) gives an attacker on the same…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.