Vulnerabilities
Microsoft fixes 1,235 flaws and an Outlook zero-day in November Patch Tuesday
Microsoft's November 2026 Patch Tuesday addressed a record 1,235 vulnerabilities, including an Outlook zero-day used to steal account hashes. Users are urged to update systems promptly.
Ross GrantUpdated 2 min read
The short version
Microsoft released a large batch of security updates in November 2026, fixing 1,235 flaws across its products. One of these flaws was a serious bug in Outlook that attackers were already using to steal password data. If someone opened a malicious attachment, their account information could be exposed. Users and organisations should install the latest updates as soon as possible.
By the numbers
- 1,235vulnerabilities patched by Microsoft in November 2026BleepingComputer
- 1Outlook zero-day actively exploited to steal NTLM hashesBleepingComputer
What happened?
Microsoft released security updates for 1,235 vulnerabilities in its November 2026 Patch Tuesday, including a zero-day flaw in Outlook that was actively exploited to steal NTLM account hashes. The flaw allowed attackers to capture authentication information if a user opened a malicious attachment. Details are based on secondary reporting; Microsoft has not yet published its own advisory.
What was taken
The most serious flaw patched this month was a zero-day vulnerability in Microsoft Outlook. Attackers exploited this bug to steal NTLM account hashes. NTLM hashes are a type of password representation used by Windows for authentication. If attackers capture these hashes, they can try to crack them offline and use the credentials to access corporate accounts without permission. According to BleepingComputer (opens in a new tab), the attack worked by sending a specially crafted message file. If a user opened it, Outlook would connect to an attacker-controlled server and send the NTLM hash without warning the user.
How the flaw works
This Outlook vulnerability is known as an NTLM credential disclosure flaw. When a user opens a malicious attachment, Outlook connects to a remote server, sending the user's NTLM authentication hash automatically. The attacker can then capture this hash and attempt to crack it, potentially gaining access to the user's accounts. Exploitation requires the user to open the attachment and have network connectivity, but does not require the attacker to be authenticated. Similar flaws have been used in phishing campaigns in the past.
The response
Microsoft released security updates for 1,235 vulnerabilities across its products in November 2026. This includes the Outlook zero-day, which was being actively exploited. The update also fixed issues in .NET, Active Directory, Azure, and other components. BleepingComputer (opens in a new tab) reports that users should apply these updates as soon as possible to protect against known attacks. Other vendors, such as Cisco, Google, and Ivanti, also released important patches this month.
What you should do
If you use Microsoft Outlook or other Microsoft products, check for and install the latest updates immediately. Security teams should review their patch management processes to ensure all critical updates are applied quickly. Users should be cautious about opening unexpected attachments, even after updates, as attackers often use email as an entry point. Organisations should also monitor for signs of credential theft and consider additional protections like multi-factor authentication.
At the time of writing, these details come from secondary sources. Microsoft has not yet published its own advisory confirming the specifics of the Outlook zero-day or the total number of flaws fixed. The exact impact and which versions are affected may become clearer once Microsoft releases more information.
Why it matters
A zero-day in Outlook was being used to steal account credentials, putting organisations at risk of compromise. The record number of flaws patched highlights the ongoing challenge of keeping software secure and up to date.
Key points
- Microsoft patched 1,235 vulnerabilities in November 2026.
- A zero-day flaw in Outlook was used to steal NTLM account hashes.
- Attackers could use stolen hashes to access corporate accounts.
- Prompt patching and user caution are essential to reduce risk.
- Details are based on secondary sources; more information may follow.
Sources
Help Net Security
Reference
BleepingComputer
Reference
