{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/server-message-block/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*","cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:*:*","cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-116928"},{"cvss":6.5,"id":"CVE-2026-124194"},{"id":"CVE-2026-113753"},{"id":"CVE-2026-113856"},{"id":"CVE-2026-113860"},{"id":"CVE-2026-112967"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows","Outlook","Word","Active Directory Domain Services","Windows Message Queuing","Server Message Block","Print Spooler"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThe November 2026 security release addresses 1,252 vulnerabilities, with a specific focus on remote code execution (RCE) in identity services (LDAP, AD DS) and preview-pane triggered vulnerabilities in Microsoft Office. A notable zero-day, CVE-2026-124194, is actively exploited in the wild, allowing unprompted NTLMv2 hash disclosure. Critical RCE vulnerabilities (CVE-2026-112967, CVE-2026-116928) present significant risk to Windows network services.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-124194 allows attackers to capture NTLMv2 hashes for relay or offline cracking. RCE vulnerabilities in LDAP and AD DS provide paths to domain-wide compromise, while privilege escalation flaws in Hyper-V affect both server infrastructure and workstations utilizing Virtualization-Based Security (VBS).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all Windows and Office environments immediately, prioritizing systems running AD DS, LDAP, and Hyper-V components.\u003c/li\u003e\n\u003cli\u003eReview and implement policies to restrict outbound NTLM traffic at the perimeter to mitigate the impact of hash-leak vulnerabilities.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected network connections initiated by Outlook or office applications to external IP addresses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T07:21:24Z","date_published":"2026-11-11T01:38:42Z","id":"https://feed.craftedsignal.io/briefs/2026-11-microsoft-patch-tuesday-f6a83d66/","summary":"Microsoft released 1,252 patches for November 2026, including 68 critical vulnerabilities and one actively exploited zero-day (CVE-2026-124194) involving silent NTLMv2 credential harvesting in Outlook.","title":"Microsoft: November 2026 Patch Tuesday Security Updates","url":"https://feed.craftedsignal.io/briefs/2026-11-microsoft-patch-tuesday-f6a83d66/"}],"language":"en","title":"CraftedSignal Threat Feed - Server Message Block","version":"https://jsonfeed.org/version/1.1"}