Patching
November Patch Tuesday: the Outlook hash leak to fix first
An exploited Outlook flaw leaks NTLM hashes across November's fixes. The order to patch, plus the Paint fix Windows Update never delivers.
Microsoft's November 10, 2026 release carries one zero-day that is already being used in attacks: CVE-2026-124194, a spoofing flaw in Outlook. An unauthenticated attacker sends a specially crafted message file, and opening it makes Outlook reach out to a server the attacker controls, handing over the user's NTLMv2 authentication hash in the process. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal remediation deadline of November 24, 2026.
Microsoft rates it Moderate, with a CVSS score of 6.5, which undersells it. The score is low because the flaw leaks a credential rather than running code, but a leaked NTLM hash is a working path to impersonating the user or cracking their password offline, and it is being exploited now. That combination, not the number, is why it sits at the top of this month's list. The rest of the release is large: trackers put the total between about 1,093 and 1,094 CVEs (Tenable and SecurityWeek), while BleepingComputer counts 1,235 under a wider scope, and 63 are rated Critical.
How the Outlook hash leak works
NTLMv2, short for NT LAN Manager version 2, is the challenge-and-response scheme Windows uses to prove who you are to a file share or another Windows service. When a Windows client connects to a server, it signs a challenge with a value derived from the user's password hash and sends that back. Anyone who captures that response holds the user's NTLMv2 hash.
The flaw turns Outlook into the thing that starts such a connection. A crafted message file contains a reference that points not to a local resource but to a remote path the attacker owns, for example a file share or a WebDAV endpoint reachable over the internet. When Outlook processes the file, Windows tries to authenticate to that path automatically, the way it would to any share, and sends the NTLMv2 handshake to the attacker's server without asking the user anything.
From there the attacker has two moves. They can relay the handshake straight to another service that accepts NTLM, such as an internal file server, a domain controller or an Exchange endpoint, and act as the user on it, which works wherever that service does not enforce signing or channel binding. Or they can take the captured hash offline and crack it, which is fast for a weak or reused password. Either way the attacker never needed the password itself, only the message in front of the user.
The two 9.8 RCEs facing the network
Two critical remote code execution flaws score far higher than the Outlook zero-day and are not known to be exploited yet, but both can be reached over the network with no login, which is exactly the shape worms and mass scanners look for.
CVE-2026-116928 in Windows Search is a pre-authentication remote code execution flaw at CVSS 9.8. CVE-2026-119958 in Windows LDAP, the Lightweight Directory Access Protocol that clients use to query directory services, is also pre-authentication remote code execution at CVSS 9.8. Microsoft currently assesses both as "Exploitation Less Likely," but a 9.8 on a service that answers the network does not stay quiet for long once the patch is studied.
One more deserves a place in this tier. CVE-2026-119952 in Schannel, the Windows component that handles TLS and SSL, is remote code execution at CVSS 8.1, and Microsoft tags it "Exploitation More Likely." Schannel sits underneath anything that terminates HTTPS on a Windows host, so this is worth pulling forward even though its score is lower than the two above.
The Paint fix Windows Update does not deliver
CVE-2026-83844 is an out-of-bounds read in Microsoft Paint, rated Important at CVSS 8.1, that can lead to code execution and is reachable over the network without the user clicking anything. The catch is delivery. Paint is now a Microsoft Store application, so its fix ships through the Store, not through Windows Update. A machine that is fully current on Windows Update can still be running a vulnerable Paint, and several outlets reported the Store was slow to hand out the fixed build.
That is the practical trap this month. Normal patch management, built around Windows Update and WSUS, does not see Store apps at all. If your estate relies on it alone, Paint stays open until someone checks the Store channel directly.
What to do, in order
Work the release in three passes rather than treating a thousand fixes as one job.
First, the exploited Outlook flaw. It is delivered through Office and Microsoft 365 Apps update channels, so confirm your Click-to-Run clients have taken the November update on your chosen channel (Current Channel, or Monthly Enterprise Channel if you defer), and push the matching security update to any perpetual MSI installs. This is the one with a November 24 federal deadline and live exploitation, so it goes first everywhere Outlook runs.
Second, the network-facing remote code execution flaws. Patch Windows Search, Windows LDAP and Schannel across servers that answer the network, starting with domain controllers and anything internet-facing, then the rest of the server estate. These are the standard monthly cumulative updates, so they install through Windows Update and WSUS as usual.
Third, Paint. Update it from the Microsoft Store (open the Store, go to Library, choose Get updates) and confirm the installed version is the fixed build the advisory lists, since early reports noted the Store lagged behind the catalog. On managed fleets, check whether your Store-for-Business or Intune channel has the new package, because this is the fix your Windows Update reporting will not show as missing.
Mitigations beyond patching
The Outlook flaw is a credential leak, so hardening NTLM limits the damage even where a user is tricked before the patch lands. Block outbound SMB on TCP port 445 and outbound NTLM to the internet at the perimeter firewall, so a captured handshake cannot leave in the first place. Inside the network, enforce SMB signing and LDAP signing and turn on Extended Protection for Authentication on services that accept NTLM, which breaks the relay path. Windows 11 now enables NTLM message signing by default for non-anonymous connections, so test that against older clients before a wide rollout. Where you can, restrict outgoing NTLM with the Group Policy setting "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers," moving from audit to block once you know what still depends on it.
If your team does not have a clear picture of which hosts face the network, which run directory and TLS services, and which Store apps are current, that inventory is the work that makes a release like this routine instead of frantic. Our safeguarding and hardening work closes those gaps and keeps them closed, and our on-demand risk reduction team can help clear a backlog when the month is this big. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: Rapid7, Splashtop, Cybersecurity News, CSO Online, BleepingComputer, The Hacker News on the Paint fix, SC World on CVE-2026-83844.