November 2026 Patch Tuesday: 63 Critical Microsoft fixes, plus an Outlook zero day that allows theft of hashed credentials
CSO Online ·
A currently exploited zero-day vulnerability that can let attackers steal hashed Outlook NTLM credentials is among the 1,094 holes Microsoft fixed in its November Patch Tuesday releases. Although rated as only moderate in severity, with a CVSS score of 6.5, Windows administrators need to address CVE-2026-124194 immediately because threat actors are already attacking it. “Don’t let the low score fool you,” said Nick Carroll, cyber incident response manager at Nightwing. Affected products include Microsoft 365 Apps for Enterprise, and Office LTSC 2021 and 2024. However, since the user has to open a malicious Office file to launch the attack, good employee cybersecurity awareness training and an effective email gateway could mitigate this attack until the patch is installed. Opening the malicious file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. The vulnerability discloses a user’s NTLMv2 password hash to the attacker, who may be able to relay it to other systems to sign in as the user, or crack it to recover the password. Microsoft, which has been using its AI model to find thousands of vulnerabilities in its products since the summer, credited an Anthropic researcher using the Claude AI assistant for finding the Outlook vulnerability. That led Satyam Narang , senior staff researcher at Tenable, to comment, “for most of the year, AI has been building bigger haystacks across Patch Tuesday releases, and this appears to be the first time it has found a needle.” Separately, SAP plugged a critical memory corruption vulnerability dubbed ICM2Shell, with a CVSS rating of 10. Discovered by researchers at Onapsis, the vulnerability impacts the way the SAP Kernel handles WebSocket traffic. Onapsis said that a specially crafted sequence of WebSocket messages could either crash a process or allow an attacker to run code remotely. Affected are SAP Internet Communications Manager (ICM), which is inside the kernel, and SAP Web Dispatcher, a reverse proxy many organizations place at the edge of their network. Microsoft patches Of the 1,094 Microsoft vulnerabilities, 63 were rated as critical. Four flaws carry a CVSS severity score of 9.8, noted Jack Bicer , director of vulnerability research at Action1, and three of them need no credentials and no user action to exploit. The Windows LDAP Remote Code Execution Vulnerability ( CVE-2026-119958 ) lets an unauthenticated attacker run code inside the Windows LDAP service, which puts domain controllers and the whole Active Directory environment at risk. The Microsoft Exchange Server Remote Code Execution Vulnerability ( CVE-2026-118207 ) can be triggered by anyone able to send email to the organization, Bicer said, and the Windows Xbox Live Networking Service Remote Code Execution Vulnerability ( CVE-2026-112967 ) gives an attacker on the same network full control of a Windows system. The fourth, the Azure OpenAI Elevation of Privilege Vulnerability ( CVE-2026-119990 ), sits in a cloud service many teams now depend on. However, this service is automatically patched by Microsoft. Patch order should follow reach, not product names, Bicer advised CSOs. Domain controllers and Exchange servers go first, he said, followed by anything that exposes IIS, Microsoft Secure Channel (Schannel) or RPC to untrusted networks. Message Queuing deserves an inventory before it gets a patch: find every server where the service is enabled, turn it off where no application needs it, and patch the rest the same day, he said, adding that hypervisor hosts need their own maintenance window, because one escaped guest becomes a problem for every tenant on that host. “What defenders need to know and do right now is abandon broad triage and take immediate defensive action,” said Dustin Childs , head of threat awareness at TrendAI’s Zero Day Initiative. That means first patching Exchange and domain controllers (meaning LDAP/Kerberos) to stop zero-click compromise, ring-fence exposed network services like DNS and DHCP to prevent wormable spread, and verify manual administrative fixes on cloud services your organization uses. Tyler Reguly , associate director of security R&D at Fortra, observed that there are fewer Microsoft vulnerabilities this month than there were in October, but noted, “I’m not foolish enough to think that this single drop indicates that we’re into the downward trend that I predicted we’ll see in the coming months. Instead, I think that we’re seeing a continuation of the elevated numbers as Microsoft continues to fix long hidden issues that are being surfaced by AI. Soon, however, these numbers will begin to decline as the last of these long-hidden issues are resolved and we only have new bugs to deal with.” CSOs can help their teams by ignoring any noise coming from vendors and any vulnerabilities that are overhyped, Reguly said. When vulnerability counts started to rise, it was C-level employees who jumped up the fastest and added to the burden their admins were facing. “Now it’s time to settle down and support your teams rather than increasing their burden. CSOs should keep in mind that AI companies and security vendors may needlessly hype unimportant vulnerabilities because it is cheap, effective marketing for their services,” he pointed out. “A vulnerability isn’t critical if you don’t have the impacted software deployed.” Prevention is key, so CSOs should focus their efforts on system hardening and mitigation. This, he said, will be more effective than chasing vulnerabilities. Finally, Reguly reminded CSOs that prioritization matters. “If you’ve developed a prioritization strategy that works for you, don’t change your process just because the media is looking for clicks,” he said. SAP patches The critical vulnerabilities collectively known as ICM2Shell are CVE-2026-76964 and CVE-2026-89126 . Researchers at Onapsis, who discovered them, said exploitation isn’t theoretical; they provided SAP with a working exploit that achieves full, unauthenticated remote code execution end to end, running arbitrary commands as adm on the target system. The denial-of-service condition, in turn, reproduced on every SAP Kernel release tested. To access the flaw, an attacker only needs network access to the HTTP/HTTPS port, says Onapsis. Because WebSocket support is enabled by default in both the ICM and the SAP Web Dispatcher, a system is exposed even if no application uses WebSocket. Some services, including default ICF services in SAP S/4HANA, accept WebSocket connections without authentication, and in others the flaw can be reached before authentication takes place. “Nothing in the chain requires an SAP user, a password or a certificate,” the researchers said. The adm account owns the SAP installation, the researchers pointed out, including its executables, its instance profiles, its secure store, and its connection to the database. Running commands as that user grants full control of the SAP system. An attacker could, among other things recover database credentials and other secrets from the secure store and profiles and use them to read or alter any business data directly in the database; collect RFC destinations and technical credentials that let them move on to the SAP and non-SAP systems connected to this one; change configuration or binaries to keep persistent access; and destroy data. Other patches Chris Goettl , VP of product management at Ivanti, drew attention to patches from Adobe, Mozilla and Google. Adobe released nine security bulletins that resolve 110 CVEs, 22 of which are critical. Adobe said it is not aware of any exploits in the wild. The two Priority 2 updates carry the most risk; Connect (APSB26-191) has the largest count at 24 CVEs, 18 of them critical and six rated CVSS 10.0. The vulnerabilities span SSRF, path traversal and SQL injection, and affect Windows on-prem versions 12.12 and earlier. The Experience Manager (APSB26-189) patch fixes 14 CVEs, including four Critical code execution flaws rated CVSS 9.9. Google Chrome 157.0.8103.50, released on Monday, resolved nine CVEs including CVE-2026-125350 , which is being actively exploited in the wild. This marks Chrome’s eighth zero-day exploit of 2026, Goettl noted. Chromium-based browsers such as Microsoft Edge will need the fix as well, and users should relaunch after updating for the patch to take effect. This patched release follows Chrome 157’s November 3 release, which fixed 213 vulnerabilities, seven of them critical. Separately, Google’s November Android bulletin fixed 216 vulnerabilities, 23 of them critical, with none marked as exploited. The target is patch level is 2026-11-05 or later. Mozilla’s November 10 release includes Firefox 160, which resolves 99 CVEs (57 of them are ranked High). Firefox ESR 153.7 resolves 81 vulnerabilities. (51 High), and ESR 115.45 resolves 28, all High. Many of the High-rated issues are use-after-free and memory boundary flaws across graphics, DOM, layout, and JavaScript components, including a number of sandbox escapes such as CVE-2026-124907 , a use-after-free in CanvasWebGL that allows privilege escalation and sandbox escape. The same flaw is addressed in Thunderbird 160 and Thunderbird 153.7.