November Patch Tuesday boasts over 1,000 bugs, one already under attack

It’s another doozy of a Patch Tuesday, with Microsoft fixing 1,094 bugs in its products, including one that attackers exploited before Redmond released a patch. Jake Knott, head of threat intelligence at exposure management firm watchTowr, succinctly said in an email to The Register: “Maybe we should just go home.” “Most security teams haven’t quite recovered from the last month of bumper-to-bumper critical vulnerabilities, emergency patches, and ‘2shell’-branded everything, and we’re yet again at another Patch Tuesday,” Knott told us. Starting with the zero-day: It’s an Outlook spoofing vulnerability, tracked as CVE-2026-124194, and it only garnered a 6.5 out of 10 CVSS rating. But as Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, warns, don’t let the score or the name lull you into thinking it’s OK to put off patching this one. “It’s labeled spoofing, but the impact is bigger than the name suggests,” Childs said in his monthly Patch Tuesday review. “An attacker sends a specially crafted message file and convinces a user to open it,” he wrote. “Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user’s NTLMv2 hash. The attacker can use that hash to authenticate as the user.” Microsoft marked CVE-2026-124194 as exploited, but per usual didn’t say when the attacks started, who is battering this bug, and what they are doing with the access post exploitation. These det...