Microsoft flags exploited Outlook NTLMv2 leak CVE-2026-124194 at CVSS 6.5 inside a 1,094-CVE November drop

Microsoft’s November 2026 Patch Tuesday lists 1,094 vulnerabilities, 726 in Windows and 174 in Office, plus 59 in SQL Server, 27 in SharePoint, and nine in Exchange. The item carrying an exploitation flag is CVE-2026-124194, an Outlook spoofing flaw in Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Opening a crafted message file can make Outlook contact an attacker-controlled location without the external-content warning and disclose an NTLMv2 hash. The Preview Pane does not trigger it. Microsoft rates the bug moderate, CVSS 6.5.

The evidence trail is thin. SecurityWeek reports Microsoft’s advisory gives no information on observed attacks, and the flaw was not publicly disclosed before the fix. Discovery credit goes to a researcher using the moniker nono and to Benoît Sevens, whose acknowledgment, per that report, mentions Anthropic’s Claude. That is a vendor statement plus a secondary write-up, not packet captures, samples, or an independent lab reproduction. NTLMv2 disclosure is still enough, on networks that have not killed NTLM, for relay or pass-the-hash impersonation. User interaction is the reason the score stays at 6.5, not proof the impact is minor.

Official versus independent attribution: Microsoft says exploited. No government bulletin, no named intrusion set, and no third-party telemetry is in the public record attached to this CVE. Do not read a state actor into an empty advisory. The class is familiar. CVE-2023-23397, tracked by Microsoft and added to CISA’s Known Exploited Vulnerabilities catalog, was an Outlook NTLM leak that did not need the same click path and was tied, on Microsoft and CERT-UA reporting, to activity Microsoft calls Forest Blizzard. This bug is narrower. Same residue: Outlook still speaks NTLM to wherever a message points.

The 1,094 figure is an accounting event as much as a code event. SecurityWeek notes 165 republished third-party CVEs; October’s 1,413 was the prior high, and year-to-date Microsoft has cleared more than 5,000. Raw totals mix Windows, Office, Azure, and inherited issues. The Zero Day Initiative has long treated Patch Tuesday volume as a poor proxy for attacker interest. Operational fact from the same release notes: Enterprise and Education Windows 11 23H2 stop monthly updates here. Estates still answering NTLM will see this class again. Watch CISA’s catalog, not the severity label.