Microsoft Fixes More Than 1,000 Security Flaws as Outlook Vulnerability Comes Under Attack

Microsoft has released its November 2026 Patch Tuesday security updates, addressing more than 1,000 vulnerabilities across its software products, including an Outlook flaw that attackers have already exploited. Cybersecurity firm Rapid7 has highlighted several serious weaknesses that could expose businesses to credential theft and remote code execution.

Outlook Vulnerability Exploited in Active Attacks

Adam Barnett, Lead Software Engineer at Rapid7, said Microsoft identified CVE-2026-124194 as the only vulnerability in this month’s release known to have been exploited in the wild.

The spoofing vulnerability affects all supported versions of classic Microsoft Outlook.

Attackers can exploit the weakness by persuading a user to open a specially crafted malicious file. This can cause Outlook to connect silently to an attacker-controlled location, potentially exposing the user’s NTLM v2 authentication hash.

Although the vulnerability carries a Common Vulnerability Scoring System (CVSS) rating of 6.5, Barnett warned that its practical consequences could be more serious.

Stolen authentication hashes could allow attackers to impersonate legitimate users when accessing other services or attempt to recover passwords through offline cracking techniques.

Outlook Preview Pane Not Affected

Barnett explained the potential danger through an analogy involving an apparently harmless postcard that secretly triggers the disclosure of sensitive information.

He compared the scenario to opening an unexpected file in an Outlook inbox without realising that the action could expose authentication credentials.

However, Barnett confirmed that Outlook’s Preview Pane cannot be used to exploit the vulnerability, potentially reducing the likelihood of successful attacks.

Windows Security Flaws Raise Remote Code Execution Concerns

Rapid7 also identified two vulnerabilities that could allow attackers to execute malicious code remotely without first authenticating to a targeted system.

Schannel Vulnerability Threatens Windows Systems

CVE-2026-119952 affects Schannel, Microsoft’s implementation of Transport Layer Security (TLS), which helps secure communications between computers and online services.

According to Barnett, attackers could potentially exploit the vulnerability by sending specially crafted malicious network packets to a vulnerable Windows system.

Because Schannel supports encrypted communications across numerous Windows services, the weakness could affect a broad range of endpoints.

Microsoft’s advisory indicates that exploitation requires specific conditions. Nevertheless, the company considers exploitation more likely, suggesting that reliable attack techniques may be achievable.

Barnett also noted that attackers may not need an existing presence on the same network subnet to exploit the vulnerability in many circumstances.

Exchange Server Vulnerability Could Be Triggered by Email

Another significant issue, CVE-2026-116928, involves the interaction between Microsoft Exchange Server and Windows Search.

The vulnerability could allow an unauthenticated attacker to achieve remote code execution by sending an email containing a malicious attachment.

Windows Search automatically indexes email content on behalf of Exchange, potentially processing the malicious attachment without direct user interaction.

Barnett warned that this integration between Microsoft services creates a particularly concerning attack scenario.

“Could someone take control of your Exchange server by sending a single email? In short: yes,” Barnett said.

Importantly, the security fix applies to Windows rather than Exchange itself.

Rapid7 also advised organisations to use Exchange Subscription Edition, as earlier Exchange versions are no longer supported.

Microsoft’s Patch Tuesday Vulnerability Count Remains High

Microsoft’s November security release continues a trend of unusually large monthly updates.

The reported figures include 1,092 vulnerabilities across Microsoft products and 1,102 Windows vulnerabilities, according to Rapid7. The differing totals were not reconciled in the original reporting.

Barnett described the latest release as a relative reprieve compared with recent months, despite the number of fixes remaining above 1,000.

The scale of Microsoft’s patching activity has also raised questions about whether fixing substantially more vulnerabilities necessarily delivers better long-term security.

“The jury is still out on whether patching many more vulnerabilities will lead to better security outcomes; every code change to resolve a known vulnerability could easily introduce new hidden treasure for researchers or threat actors to unearth in the future,” Barnett said.

Only One Vulnerability Confirmed as Exploited

Despite the substantial number of security fixes, Rapid7 observed that there has not been a corresponding increase in Microsoft vulnerabilities known to be actively exploited.

Microsoft reported no publicly disclosed vulnerabilities in the November release and confirmed active exploitation of just one flaw.

This distinction highlights the importance of assessing vulnerabilities according to their potential impact, exploitability and exposure rather than relying solely on the total number of security updates.

Microsoft Product Support Changes Affect Organisations

Alongside the security fixes, Microsoft has reached several product lifecycle milestones.

According to Rapid7, the following products have passed their respective release end dates:

• .NET 8 Long Term Servicing (LTS)

• PowerShell 7.4 LTS

• Windows 11 Enterprise, Education and IoT editions covered by the relevant lifecycle deadlines

Organisations should review their software versions and support arrangements to determine whether upgrades or additional maintenance measures are required.

Australian Businesses Urged to Prioritise Security Updates

The November Patch Tuesday release reinforces the importance of maintaining supported Microsoft software and promptly addressing vulnerabilities affecting critical business systems.

For Australian organisations relying on Outlook, Windows and Exchange Server, the confirmed exploitation of an Outlook weakness and the potential for unauthenticated remote code execution present significant security considerations.

While Microsoft’s expanding patch volume raises questions about long-term software security, timely updates, effective vulnerability management and careful monitoring remain essential to reducing exposure to cyberattacks.