Server Message Block - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/server-message-block/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 01:38:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMicrosoft: November 2026 Patch Tuesday Security Updateshttps://feed.craftedsignal.io/briefs/2026-11-microsoft-patch-tuesday-f6a83d66/Wed, 11 Nov 2026 01:38:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-microsoft-patch-tuesday-f6a83d66/Microsoft released 1,252 patches for November 2026, including 68 critical vulnerabilities and one actively exploited zero-day (CVE-2026-124194) involving silent NTLMv2 credential harvesting in Outlook.The November 2026 security release addresses 1,252 vulnerabilities, with a specific focus on remote code execution (RCE) in identity services (LDAP, AD DS) and preview-pane triggered vulnerabilities in Microsoft Office. A notable zero-day, CVE-2026-124194, is actively exploited in the wild, allowing unprompted NTLMv2 hash disclosure. Critical RCE vulnerabilities (CVE-2026-112967, CVE-2026-116928) present significant risk to Windows network services.

Impact

Successful exploitation of CVE-2026-124194 allows attackers to capture NTLMv2 hashes for relay or offline cracking. RCE vulnerabilities in LDAP and AD DS provide paths to domain-wide compromise, while privilege escalation flaws in Hyper-V affect both server infrastructure and workstations utilizing Virtualization-Based Security (VBS).

Recommendation

  • Patch all Windows and Office environments immediately, prioritizing systems running AD DS, LDAP, and Hyper-V components.
  • Review and implement policies to restrict outbound NTLM traffic at the perimeter to mitigate the impact of hash-leak vulnerabilities.
  • Monitor for unexpected network connections initiated by Outlook or office applications to external IP addresses.
]]>criticalthreat