CVE-2026-124194: Microsoft’s Record November 2026 Patch Tuesday — Exploited Outlook Zero-Day Leaks NTLM Hashes

Microsoft’s November 2026 Patch Tuesday arrived on November 10 with a staggering 1,235 security fixes — and buried in the pile is the one vulnerability that keeps every security team awake: an actively exploited Outlook zero-day that silently hands attackers your users’ Windows credentials. CVE-2026-124194 is in the wild right now, and if your organisation hasn’t patched Microsoft 365 Apps or Office LTSC yet, your employees’ NTLMv2 hashes may already be en route to a threat-actor’s relay server.

Why November 2026 Patch Tuesday Is Historic

When Microsoft ships a Patch Tuesday, the security community braces itself. November 2026’s release is unprecedented in scale. BleepingComputer’s count puts the total at 1,235 flaws; Tenable and Rapid7 counted between 1,092 and 1,093 Microsoft-product CVEs, with the discrepancy arising from how third-party and advisory-linked bugs are tallied. By any measure, this is the single largest Patch Tuesday in the company’s history, eclipsing October 2026’s 1,411-flaw behemoth and July 2026’s 570-CVE release. Of this month’s fixes, 63 are rated Critical and one — CVE-2026-124194 — is confirmed actively exploited.

For Indian enterprise and government IT teams already stretched thin by AI-powered threat campaigns and CERT-In advisories, the scale here is not abstract. Each Critical patch represents a potential entry point for ransomware groups, APT actors, and opportunistic credential-harvesters. Prioritising in this environment requires a framework — and CVE-2026-124194 sits unambiguously at the top of the queue.

CVE-2026-124194 Deep Dive: How the Outlook Zero-Day Works

The MSRC advisory classifies CVE-2026-124194 as a Microsoft Outlook Spoofing Vulnerability with a CVSS 3.1 base score of 6.5 (Medium). Do not let the “Moderate” label fool you. The Zero Day Initiative’s November review explicitly warns that “the impact is bigger than the spoofing label suggests,” because successful exploitation delivers NTLMv2 hash capture — the same primitive that drives credential-relay, pass-the-hash, and lateral-movement attacks across Active Directory environments.

The attack chain is elegantly simple:

1. An attacker crafts a malicious .msg or .eml file and delivers it via email, file share, or phishing link.
2. A user opens (not merely previews) the file in Outlook.
3. Without any visible warning, Outlook makes an outbound connection to an attacker-controlled network resource — a UNC path or WebDAV share on the internet.
4. Windows attempts to authenticate that connection using the user’s credentials, and in doing so, transmits the user’s NTLMv2 hash.
5. The attacker captures that hash and can relay it in real time to authenticate against any corporate service that accepts NTLM — Exchange, SharePoint, file servers, internal web applications.

Microsoft’s advisory is unambiguous: “This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.” The attack is network-based, requires no prior authentication, and demands only that a user open a file — a low bar in a phishing-heavy threat landscape.

Microsoft has confirmed this is actively being exploited in the wild, though as of publication the company has not disclosed the identity of the threat actors or the timeframe of the initial exploitation. CISA’s KEV listing confirms the seriousness: federal agencies must remediate by November 24, 2026.

The Supporting Cast: Other High-Priority Patches This Month

Even with CVE-2026-124194 at the top, several other November fixes demand urgent attention:

CVE	Component	CVSS	Key Risk	Status
CVE-2026-124194	Microsoft Outlook	6.5	NTLMv2 hash leak → credential relay	Actively Exploited, CISA KEV
CVE-2026-116928	Windows Search (via Exchange)	9.8	Zero-click RCE via crafted email attachment	Not exploited yet — Exploitation Less Likely
Exchange Server RCE	Exchange Server SE	8.8	Remote code execution	Exploitation More Likely
Schannel RCE	Windows Schannel (TLS stack)	8.1	TLS stack RCE, broad attack surface	Exploitation More Likely

CVE-2026-116928 deserves special mention for Indian data centre operators running Exchange Server. According to Rapid7, the attack requires only that an attacker send a crafted email with a malicious attachment: Exchange indexes it automatically, and Windows Search processes it without any user interaction — a true zero-click RCE vector against the Windows OS layer. The patch is to Windows components, not Exchange itself, so Exchange Server version doesn’t change the exposure. With a CVSS score of 9.8, this is a tier-1 emergency fix for any on-premises Exchange environment, even though Microsoft currently rates exploitation as “Less Likely.”

The NTLM Relay Threat: Why This Matters More in India

For security teams in India’s banking, financial services, insurance (BFSI), and IT-services sectors — where Active Directory remains the backbone of enterprise identity — NTLM relay attacks represent a persistent, well-understood, and devastatingly effective threat class. Many Indian enterprises still run hybrid environments with a mix of cloud Microsoft 365 and on-premises Active Directory, and NTLM is often not fully disabled due to legacy application dependencies.

When an attacker obtains an NTLMv2 hash via CVE-2026-124194, they can:

• Relay it in real time using tools like Responder or ntlmrelayx to authenticate against SMB shares, Exchange, or LDAP without cracking the hash.
• Crack it offline using GPU clusters — NTLMv2 hashes for weak passwords can be cracked in seconds with modern hardware.
• Use it for lateral movement — once inside, attackers pivot to high-value systems, deploy ransomware, or establish persistent access for data exfiltration.

This exact attack chain — spear-phishing a crafted Office file → NTLM hash capture → relay → domain compromise — is documented in multiple threat actor playbooks. The low complexity and the absence of a Preview Pane trigger means well-crafted spear-phishing emails are all that separate a threat actor from your Active Directory.

What You Should Do Right Now

As a cybersecurity practitioner who has seen NTLM relay attacks executed against Indian enterprise networks, here is my prioritised defence checklist for the next 72 hours:

1. Patch Microsoft 365 Apps and Office LTSC immediately. The fix for CVE-2026-124194 is delivered via the Office Click-to-Run update mechanism. It is not part of the Windows cumulative update (KB5132061/KB5131087). Confirm that your Click-to-Run clients have moved to the fixed build listed in the MSRC advisory. Use Microsoft 365 Apps admin centre or Intune to enforce the update.
2. Patch Windows (KB5132061 / KB5131087) on all Exchange-adjacent systems. This covers CVE-2026-116928, the Exchange-reachable Windows Search RCE. Apply the November 2026 Cumulative Update to all Windows Server instances hosting or fronting Exchange, even before exploitation is confirmed.
3. Enable Protected Users security group for privileged accounts. Accounts in Protected Users are denied NTLM authentication entirely. This is the single most effective mitigation against NTLMv2 hash relay attacks and should be in place for all Domain Admins, tier-0 service accounts, and executive mailbox owners.
4. Restrict and audit outbound NTLM traffic. Use Group Policy (Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers) to block or audit outbound NTLM. At minimum, audit and alert on outbound NTLM to external IP addresses.
5. Block outbound SMB (port 445) and WebDAV (port 80/443) to the internet at your perimeter firewall. This prevents the hash from reaching an attacker-controlled server even if Outlook is unpatched. FortiGate firewalls can enforce this via Application Control and Web Filter policies.
6. Alert on anomalous outbound NTLM authentication events. Windows Event IDs 4624 (Type 3) and 4648 against external IPs are your canary — integrate these into your SIEM or SOC playbooks.
7. Apply the Exchange Server and Schannel patches in your next maintenance window. Both carry “Exploitation More Likely” tags from Microsoft — these will be weaponised within days of a public PoC appearing.

For a deeper look at how zero-trust architecture can structurally limit the blast radius of credential-relay attacks in Indian enterprise environments, see my Zero-Trust Campus case study and my guide on high-availability SD-WAN for distributed Indian sites.

Frequently Asked Questions

Does opening the email in the Preview Pane trigger CVE-2026-124194?

No. Microsoft’s advisory explicitly states that the Preview Pane is not an attack vector. A user must open the crafted message file for the vulnerability to trigger. That said, this provides only marginal protection — phishing emails that prompt users to “open the attached report” are routine, and user awareness training alone is not a sufficient control. Patching remains the definitive fix.

We use Microsoft 365 Business Premium — are we affected?

Yes, if your users are running Microsoft 365 Apps for Enterprise (which is included in Business Premium, E3, E5, and similar plans), you are affected. The Office Click-to-Run channel delivers the fix automatically in most configurations, but verify that automatic updates are enabled and that the fix has been applied. Users running fully web-based Office (Outlook on the Web) are not affected; only the installed desktop Outlook client is vulnerable.

What is the actual risk of CVE-2026-116928 (the Windows Search CVSS 9.8) for on-premises Exchange operators?

The risk is high, but currently theoretical — Microsoft rates exploitation as “Less Likely.” The attack requires an attacker to send a specially crafted email with a malicious attachment; Exchange’s indexing service then processes it, triggering the Windows Search vulnerability with no user interaction required. Because the vulnerability is in the Windows OS layer (not Exchange itself), all supported Windows Server versions running Exchange are affected. The CVSS 9.8 score reflects the zero-click, unauthenticated, remote-code-execution nature of the flaw. Apply the November 2026 Windows cumulative update before a public PoC forces your hand.

Should Indian organisations expect CERT-In guidance on these vulnerabilities?

Yes. CERT-In regularly mirrors CISA KEV alerts and issues advisories for Critical and High-severity Microsoft CVEs. Given that CVE-2026-124194 is already in CISA’s KEV catalog and is being actively exploited, a CERT-In advisory is expected shortly. Indian organisations in regulated sectors — banking, insurance, critical infrastructure — should not wait for a CERT-In advisory to act. Patch now and document remediation for compliance purposes.

The Bottom Line: Patch Microsoft Office Before the Weekend

November 2026’s Patch Tuesday is a landmark release for all the wrong reasons. 1,235 vulnerabilities in a single month, one already weaponised in the wild, and several more rated “Exploitation More Likely” for critical infrastructure components. The actively exploited CVE-2026-124194 is deceptively simple: open one malicious file in Outlook and an attacker walks away with a credential they can use immediately. In a world where NTLMv2 relay chains remain a primary initial-access technique against Active Directory, this zero-day is the equivalent of leaving your front door unlocked during a known burglary spree.

The fix is available. The deadline is clear. The threat is confirmed. Patch now.

Need help triaging and remediating this month’s Patch Tuesday in your environment, or want to assess whether your Active Directory is exposed to NTLM relay attacks? Contact Sanjay Seth for a security assessment — with 30 years of hands-on network and cybersecurity experience across Indian enterprise environments, P J Networks can help you prioritise, patch, and protect.