Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes

Microsoft released its November Patch Tuesday update on November 11, 2026, addressing 1,259 security flaws across its products, according to coverage from The Register. Among the vulnerabilities is CVE-2026-124194, an Outlook zero-day that SOC Prime reports exposes NTLM hashes and that Forbes confirms is under active exploitation. Coverage from SaskToday.ca notes that a global Microsoft Outlook outage was reported on the same day that the U.S. cybersecurity agency confirmed active exploitation of the security flaw. The Register states that one of the bugs in the November batch was already under attack at the time of patching, while Forbes reports Microsoft's confirmation of active exploitation of the new Outlook zero-day. SOC Prime's coverage identifies the specific CVE and its connection to NTLM hash exposure. The Register's reporting frames the November Patch Tuesday as notable for its volume, describing over 1,000 bugs with one already under attack. Forbes focuses on Microsoft's confirmation that the Outlook zero-day is being actively exploited in the wild. SaskToday.ca connects the security disclosure to a reported global Outlook outage and the U.S. cybersecurity agency's confirmation of active exploitation. The coverage does not yet specify which products beyond Outlook are affected by the other 1,258 flaws, nor does it detail the scale of the outage or which organizations were targeted by the active exploitation. Readers should understand that Patch Tuesday is Microsoft's regular monthly security update cycle, and that NTLMv2 hash exposure can enable credential relay attacks against enterprise environments. The active exploitation of an Outlook zero-day raises stakes for organizations relying on Microsoft 365 and on-premises Exchange deployments. Coverage does not state whether the global outage was directly caused by the vulnerability or by the patching response. What to watch next depends on forthcoming advisories from Microsoft and the U.S. cybersecurity agency, which coverage indicates has confirmed the active exploitation but has not yet released detailed mitigation guidance beyond the patch itself. Organizations will need to assess whether their Outlook installations are patched and whether any NTLMv2 hash exposure occurred before the update was applied.