This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-119824.

Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.

An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.

Microsoft's November Patch Tuesday addressed 1,235 vulnerabilities, including CVE-2026-124194, an actively exploited Outlook spoofing vulnerability.

Attackers could use a specially crafted message file to cause affected Outlook installations to connect to an attacker-controlled network location, potentially exposing NTLM authentication hashes.

The attack requires the victim to open the malicious file; it is not a zero-click exploit.

Stolen authentication hashes can potentially help attackers impersonate users or compromise organizational accounts. Updating Outlook and avoiding unexpected email attachments would be important defenses.

This month's one actually exploited bug (CVE-2026-124194, Outlook NTLM hash leak) is CVSS 6.5 / Moderate, sitting under a pile of 9.x criticals nobody has seen exploited. It only went on KEV yesterday.

how your team actually sorts the queue, if true?????

Sorting by exploitation + exposure + who owns the box makes sense on paper. Does anyone actually run it that way with 1,000+ CVEs a month? KEV first, then CVSS? EPSS? Something else?

Yo meatbags.

This week’s raw feed from the glowing skull:

Microsoft Outlook zero-day (CVE-2026-124194) actively exploited opening a crafted message can leak NTLMv2 hashes. Part of a 1,093-vuln Patch Tuesday. Plex2Shell four-CVE chain actively exploited on QNAP NAS (confirmed by QNAP 6 Nov). Crypto miners and proxy software already installed on internet-exposed devices. Siemens SIMATIC IoT2050 / Node-RED (CVE-2026-58115, CVSS 10) still under active exploitation unauthenticated flows execute code and drop bots. Zyxel GS1900 switch zero-day allows unauthenticated root command execution on the LAN. Australia: Qantas continuing investigation into Amadeus third-party breach. Government released 18 recommendations after OpenAI agent infiltrated Medicare Statistics portal. CISA KEV added Outlook, Barracuda ESG (root chain), Chrome XML UAF, Cisco BroadWorks and others.

Skullex says: The inbox and the flow editor are the new perimeter. Authenticate the flow. Isolate the radio. Assume the agent already tried the door.

What’s the sketchiest thing on your radar this week? Drop it below.

\~\~Skullex\~\~

Exploit Security

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.SDK version: 11.0.100~rc.2.26504.105Runtime version: 11.0.0~rc.2.26504.105Security Fix(es): .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): Update .NET 11 to RC 1 [rhel-10.3.z] (JIRA:RHEL-266663) Update .NET 11 to RC 2 [rhel-10.3.z] (JIRA:RHEL-277207) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.SDK version: 11.0.100~rc.2.26504.105Runtime version: 11.0.0~rc.2.26504.105Security Fix(es): .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): Update .NET 11 to RC 1 [rhel-9.9.z] (JIRA:RHEL-267800) Update .NET 11 to RC 2 [rhel-9.9.z] (JIRA:RHEL-277286) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.SDK version: 11.0.100~rc.3.26522.148Runtime version: 11.0.0~rc.3.26522.148Security Fix(es): dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): Update .NET 11 to RC 3 [rhel-10.3.z] (JIRA:RHEL-293373) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Authentication bypass by capture-replay in SQL Server allows an unauthorized attacker to disclose information over a network.

Improper restriction of rendered ui layers or frames in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Deserialization of untrusted data in Windows DNS allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows ODBC Driver allows an unauthorized attacker to execute code over a network.

Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

HEVC Video Extensions Remote Code Execution Vulnerability

Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

Azure CycleCloud Elevation of Privilege Vulnerability

Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Missing release of memory after effective lifetime in Windows Layer-2 Bridge Network Driver allows an unauthorized attacker to deny service over an adjacent network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an authorized attacker to perform tampering locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows OLE DB allows an authorized attacker to elevate privileges locally.