November 2026 Patch Tuesday — why a 6.5-rated Outlook zero-day, CVE-2026-124194, comes first among 1,094 fixes

Microsoft's November 2026 Patch Tuesday, released on November 10 (US time), fixes more than a thousand vulnerabilities, yet only one is known to be under attack: CVE-2026-124194 in Outlook. SecurityWeek counts 1,094 flaws, Tenable and Cyber Security News count 1,093, and BleepingComputer counts 1,235. Whatever the total, administrators face the same question: where to start.

The answer is not the highest score. CVE-2026-124194 is rated Moderate with a CVSS score of 6.5, the only Moderate entry in the release. It goes first because attackers are already using it. Google patched Chrome's eighth exploited zero-day of 2026 a day earlier, on November 9, and SAP shipped four maximum-severity fixes on November 10.

1. What to patch first

Two tests come before the score: is it being exploited, and is it directly reachable from outside.

The three second-tier Microsoft entries are ones Tenable singled out, all assessed by Microsoft as "Exploitation More Likely"; the Schannel bug is reachable without authentication. BleepingComputer lists the Windows 11 cumulative updates as KB5132061 and KB5131087 and the Windows 10 extended security update as KB5131096. Because the Outlook flaw affects Microsoft 365 Apps and Office LTSC, installing Windows updates alone does not close it; the Office update has to be checked separately.

One deadline rides along: SecurityWeek and NT Compatible note that this is the final monthly security update for the Enterprise and Education editions of Windows 11 version 23H2.

2. CVE-2026-124194: what happens when one warning goes missing

Microsoft classifies the bug as spoofing under CWE-356, meaning the interface does not warn the user before an unsafe action. Nothing crashes and no code runs; a prompt that should appear simply does not.

An NTLMv2 hash is not the password itself but a response derived from it. Microsoft's advisory says the flaw discloses the hash to an attacker "who could use this to authenticate as the user." BleepingComputer adds that captured hashes can be cracked offline, and that similar NTLM leaks have been abused through phishing attachments before.

The low score follows from how CVSS is computed. Microsoft's vector shows network reach and no privileges required, but user interaction is needed and only confidentiality is affected. What an attacker does with the stolen hash afterward is outside the score. NT Compatible reports that Dustin Childs of the Zero Day Initiative warned the impact runs deeper than the "spoofing" label suggests.

Affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Microsoft has not said who is exploiting the flaw or at what scale, and it was not publicly disclosed before the fix. SecurityWeek says Microsoft credits a researcher known as "nono" and Benoît Sevens, and both SecurityWeek and Tenable note the acknowledgment mentions Anthropic's Claude model.

On workarounds: the advisory text and coverage we reviewed list no mitigation other than the patch. The only supported facts are that the Preview Pane is not a vector and that exploitation requires the user to open the file with network connectivity. Until the update is installed, not opening unexpected message-file attachments is the practical defense.

3. Why three different totals, and why so many

BleepingComputer's category table includes 142 Edge entries; subtract them and the total is 1,093. Its three extra Critical bugs are Edge use-after-free flaws. Most of the gap, in other words, is whether Chromium fixes inherited by Edge are counted. We could not determine where the one-CVE difference between 1,093 and 1,094 comes from.

By type, Cyber Security News counts 535 elevation-of-privilege bugs (48.9%), 296 remote code execution (27.1%), 156 information disclosure, 46 denial of service, 27 security feature bypass, 22 spoofing and 11 tampering. By product, SecurityWeek lists Windows at 726, Office at 174 and SQL Server at 59.

As for why the number is so large, none of the sources we read carries an explanation from Microsoft. BleepingComputer writes that the company "continues to use AI to find and patch vulnerabilities," which is the outlet's framing. What is established is the trend: October 2026 set a record at 1,413 (SecurityWeek) or 1,411 (BleepingComputer), and SecurityWeek says Microsoft has fixed more than 5,000 flaws in 2026.

Volume is not risk. Of more than a thousand entries, one is being exploited, and it carries the lowest rating on the list.

4. Chrome and SAP in the same two days

Chrome. On November 9 Google said it "is aware that an exploit for CVE-2026-125350 exists in the wild." The bug is a use-after-free in the XML component: the program frees an object but keeps a pointer to it, and an attacker can fill the vacated memory. An anonymous researcher reported it on November 6.

Users of Edge, Brave, Opera and Vivaldi need to wait for each vendor's own update.

SAP. The November 10 Security Patch Day brought 35 new notes, 4 GitHub advisories and 3 updated notes. Four flaws score 10.0: CVE-2026-89126 in Web Dispatcher (Note 3778556, a heap-based buffer overflow), CVE-2026-76964 in the NetWeaver AS ABAP ICM (Note 3778530), CVE-2026-89103 in SAP Gateway (Note 3798345) and CVE-2026-120017 in the SAML2 service provider (Note 3849308). Web Dispatcher is the front door to SAP systems and is often internet-facing. No exploitation has been reported for any of the four.

5. What to do

FAQ

Why does a 6.5 outrank an 8.8? The CVSS base score measures theoretical severity, not whether attacks are happening. This is the only entry Microsoft marks as exploited.

Can previewing an email trigger it? No. Microsoft says the Preview Pane is not an attack vector.

Is Windows Update enough? Not for the Outlook bug, which is fixed through Office updates.

Details of the Outlook and Chrome attacks remain undisclosed, as does Microsoft's own account of the rising CVE volume. Our explainers on zero-days, on how CVSS scores work and on type confusion bugs in Chrome give the background, and our report on the second Fireworks AI breach covers a supply-chain incident from the same edition.