Microsoft patches 1,259 flaws, including exploited Outlook bug that can leak NTLMv2 hashes

Microsoft closed 1,259 vulnerabilities in its latest Patch Tuesday, the second straight month above 1,000 fixes, and marked one as already exploited. CVE-2026-124194 is a Moderate Outlook spoofing flaw, CVSS 6.5. An unauthenticated attacker sends a crafted message file. If the target opens it, Outlook can reach an attacker-controlled network location without the usual external-content warning and disclose an NTLMv2 hash. Microsoft says the bug needs a network path and user interaction. That hash is not metadata. It is material an attacker can use to impersonate the user on systems that still accept NTLM.

The release, as broken out from Microsoft's tally, covers 726 Windows flaws, 174 in Office, 61 and 53 in two Developer Tools counts, 59 in SQL Server, and 27 in SharePoint Server, along with 165 CVE identifiers not issued by Microsoft. Elevation of privilege accounts for more than 500 of the set, ahead of remote code execution and information disclosure. Tenable's Satnam Narang counts more than 5,100 Microsoft CVEs addressed this year. CISA added CVE-2026-124194 to the Known Exploited Vulnerabilities catalog and set a federal remediation date of November 24, 2026. Microsoft credited researcher Nono and Anthropic's Benoît Sevens, using Claude.

Microsoft's advisory calls CVE-2026-124194 exploited and Moderate, CVSS 6.5. Those are different kinds of claims. Exploitation is the vendor's operational assertion; the score is a model that undersells one opened file leaking NTLMv2, the hash Windows still presents for network logon. Redmond named no actor, published no telemetry, and did not say whether the report landed before or after abuse began. No independent source has confirmed the in-the-wild method. On Microsoft's own description, the effect is identity theft at the protocol layer: a captured hash can be relayed or cracked into the victim's session and carried to other reachable systems.

Federal civilian agencies must apply the Outlook fix by November 24, 2026. Everyone else is sorting a queue. The defensible order is internet-exposed systems, then flaws already on CISA's exploited list, then the rest of the 1,259, and only where the component is installed. Outlook clears that filter almost everywhere; NTLM should not still be in the path. Networks that allow NTLM relay or outbound authentication to untrusted hosts keep the stolen-hash route alive after the patch exists. Two months above 1,000 fixes, and more than 5,100 Microsoft CVEs this year, mean the constraint is installation, not disclosure.