critical threat exploited November 11, 2026

Microsoft: November 2026 Patch Tuesday Security Updates

Microsoft released 1,252 patches for November 2026, including 68 critical vulnerabilities and one actively exploited zero-day (CVE-2026-124194) involving silent NTLMv2 credential harvesting in Outlook.

Triage facts

Revision 1

Applicability: Windows, Outlook +5
Evidence: Confirmed activeHigh confidence
Severity: Critical
Action: Immediate escalation
Sources: 1 public source
Freshness: Revision 1Nov 11, 01:38 UTC
Detection: 1 rule
Vulnerabilities: 6 CVEs
Source quality: A1Very likely

What's new

1. exploited:true Nov 11, 07:21 via crowdstrike

The November 2026 security release addresses 1,252 vulnerabilities, with a specific focus on remote code execution (RCE) in identity services (LDAP, AD DS) and preview-pane triggered vulnerabilities in Microsoft Office. A notable zero-day, CVE-2026-124194, is actively exploited in the wild, allowing unprompted NTLMv2 hash disclosure. Critical RCE vulnerabilities (CVE-2026-112967, CVE-2026-116928) present significant risk to Windows network services.

Impact

Successful exploitation of CVE-2026-124194 allows attackers to capture NTLMv2 hashes for relay or offline cracking. RCE vulnerabilities in LDAP and AD DS provide paths to domain-wide compromise, while privilege escalation flaws in Hyper-V affect both server infrastructure and workstations utilizing Virtualization-Based Security (VBS).

Recommendation

Patch all Windows and Office environments immediately, prioritizing systems running AD DS, LDAP, and Hyper-V components.
Review and implement policies to restrict outbound NTLM traffic at the perimeter to mitigate the impact of hash-leak vulnerabilities.
Monitor for unexpected network connections initiated by Outlook or office applications to external IP addresses.

Immediate actions

Deploy November 2026 Microsoft security patches across all systems

IT Operations 24h

Threat Hunt

Identify systems with MSMQ, SMB, or LDAP services exposed to the network

T1190 high high confidence hunt now

Data: Network listener logs

Mitigations

Apply security patches for CVE-2026-124194 and related Critical RCEs

immediate IT Operations

CVE-2026-124194, CVE-2026-112967, CVE-2026-116928

Detection coverage 1

Detect Outbound NTLM Authentication from Outlook

medium

Detects unusual network connections originating from Outlook potentially related to credential disclosure attempts

sigma tactics: credential_access techniques: T1557.001 sources: network_connection, windows

Detection queries are available on the platform. Get full rules →

Affected

Vendors

Products

Active Directory Domain Services

Windows Message Queuing

Server Message Block

Print Spooler

Operating systems

Windows

CVEs

9.8

6.5

CPE identifiers

microsoft:365_apps microsoft:office_2021 microsoft:office_2024

References

https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-november-2026/

MITRE ATT&CK

T1204.002 · TA0001

Malicious File

Initial Access

high

Exploitation requires the victim to open a malicious file delivered via email or another channel.

T1557.001 · TA0006

LLMNR/NBT-NS Poisoning and SMB Relay

Credential Access

high

A specially crafted message file can cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, disclosing the victim's NTLMv2 hash.

T1068 · TA0004

Exploitation for Privilege Escalation

Privilege Escalation

high

CVE-2026-113753, CVE-2026-113856, and CVE-2026-113860 all enable elevation of privilege within the hypervisor boundary.

CVE search metadata

Triage facts

What's new

Impact

Recommendation

Immediate actions

Threat Hunt

Mitigations

Detection coverage 1