In November’s Patch Tuesday update series, Microsoft fixed 1,094 vulnerabilities in its products. Among them was one zero-day vulnerability, meaning it could be exploited by hackers before the official update was released.
Image source: Philip Oroni / unsplash.com
The zero-day vulnerability in Outlook is registered under the number CVE-2026-124194 – its threat level is estimated at 6.5 out of 10, but the problem cannot be underestimated, experts warn. To carry out the attack, the attacker sends the victim a specially prepared file and convinces the user to open it. After this, Outlook connects to the network resource controlled by the hacker, without displaying the standard warning about downloading external content. As a result, the user’s NTLMv2 hash is leaked – an attacker can use this data to authenticate to the system on behalf of this user.
Microsoft confirmed that the vulnerability CVE-2026-124194 is already being exploited, but, as is often the case, did not specify when the attacks began, who exactly was exploiting the vulnerability, and what actions were taken after gaining access. Now that the fix has been released, other attackers may begin scanning networks for vulnerable versions of the program and studying the patch for their own attack methods. Therefore, it is recommended to install the update immediately and monitor the appearance of suspicious files in your mail.
The current package also eliminates two zero-click vulnerabilities, that is, those that do not require user interaction to deploy an attack – they are registered under the numbers CVE-2026-116928, CVE-2026-119958, and both are assigned a critical severity level of 9.8 out of 10.
Image source: BoliviaInteligente / unsplash.com
CVE-2026-116928 is an out-of-bounds write vulnerability in the Microsoft Windows Search component that could lead to remote code execution. An unauthorized attacker could exploit this search feature in Exchange by sending an email with a crafted attachment. Exchange automatically processes the attachment for indexing, so the victim does not need to open the email or file; Successful exploitation of the vulnerability allows an attacker to execute code with the rights of the service responsible for processing data.
CVE-2026-119958 is also an out-of-bounds write vulnerability in the LDAP protocol implementation. It allows attackers to execute code remotely without requiring any user interaction. To exploit it, you need to send a specially crafted LDAP request to the vulnerable system, which can lead to compromise of domain controllers. There are also 30 “worm-like” vulnerabilities, the exploitation of which does not require either user participation or network activity.
Finally, the list includes a critical vulnerability numbered CVE-2026-112967 in the Windows Xbox Live Networking Service – it also allows remote code execution. The vulnerability has a score of 9.8 out of 10; No authentication or user action is required to operate it.
If you notice an error, select it with the mouse and press CTRL+ENTER.
