On November 10, 2026, Microsoft released patches for 1,093 vulnerabilities. Among these, CVE-2026-124194 is confirmed to be actively exploited. This vulnerability allows attackers to leak NTLMv2 authentication hashes when users open a specially crafted message file.
CVE-2026-124194 affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. The vulnerability was discovered by Benoît Sevens using Anthropic's Claude. It has a CVSS score of 6.5 and is rated as moderate.
The exploitation of CVE-2026-124194 involves convincing a user to open a crafted message file in Outlook, which then connects to an attacker-controlled network location, disclosing the user's NTLMv2 hash.
CISA has added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch it by November 24. This month marks the second consecutive month where Microsoft disclosed over 1,000 vulnerabilities.
In total, Microsoft has disclosed more than 5,160 vulnerabilities in 2026. The November 2026 updates also include 63 critical vulnerabilities and a total of 1,342 CVE entries when including Chromium and open-source component fixes.