Only one of the 1,094 vulnerabilities Microsoft fixed on 10 November was already under attack. The Outlook flaw sends a user's NTLMv2 authentication hash to an attacker when a crafted file is opened.
Microsoft's monthly security release on 10 November 2026 closed 1,094 vulnerabilities, according to SOCRadar's breakdown. Only one of them was already being used in attacks before the fix shipped: CVE-2026-124194 in Microsoft Outlook. Microsoft rates it Moderate with a CVSS score of 6.5, yet its own exploitability assessment reads "Exploitation Detected".
The attack chain is short. An attacker sends a specially crafted message file. When the recipient opens it in Outlook, the client connects to an attacker-controlled network location without showing its usual external-content warning, and during that connection it hands over the user's NTLMv2 authentication hash.
Why it matters
A captured NTLMv2 hash is not the plaintext password, but it is useful in two ways. It can be relayed against internal services that do not enforce signing or Extended Protection for Authentication, or cracked offline if the password behind it is weak. Either path ends the same way: an attacker authenticating on the corporate network as a legitimate user.
Despite the modest score, the U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on 10 November 2026 and set 24 November 2026 as the remediation deadline for covered federal agencies. A KEV listing is independent confirmation that the vulnerability is being used in real attacks — which is precisely why teams that prioritise patching by CVSS score alone risk pushing this one down the queue.
What this means for businesses in Türkiye
The practical difficulty is the delivery channel. The fix ships in the November 2026 Office updates, not in the Windows cumulative update. Companies that patch servers and endpoints on schedule but leave Office to the user or to an automatic channel can end up with machines that report as current while Outlook stays vulnerable. Microsoft 365 Apps, Office LTSC 2024 and LTSC 2021 channels each need to be verified separately.
Industries that run on email attachments are the natural hunting ground here. Construction offices exchange tenders and project files, maritime and shipping agencies move manifests and certificates, logistics firms pass waybills and customs paperwork around all day — opening a document from an unfamiliar sender is simply part of the routine.
Microsoft is also tightening NTLM itself in the same release: Windows 11 security update KB5132061 turns on NTLM message signing by default for non-anonymous client connections. That is a durable improvement against relay attacks, but it is not a substitute for applying the patch.
What we recommend at Kamer Bilişim
- Track Office updates as a separate task. A current Windows build does not mean a current Office build. Inventory which version and update channel runs on each machine, then deploy the November 2026 Office update this week.
- Shrink the NTLM relay surface. Block outbound SMB traffic (ports 445 and 139) at the firewall — on its own this stops the hash from ever reaching the attacker's server. Then enforce SMB signing and LDAP signing with channel binding.
- Make accounts resilient even if a hash leaks. Long, unique passwords on administrative accounts, multi-factor authentication on critical services, and logging of outbound SMB connections originating from Outlook processes all sharply reduce what a stolen hash is worth.
If you would like help inventorying Office versions across your organisation, planning the patch rollout, or reviewing your firewall rules against this class of attack, reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: SOCRadar, "November 2026 Patch Tuesday: 1,094 Flaws, One Exploited"; CISA Known Exploited Vulnerabilities catalog.
Source: SOCRadar