Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes

Microsoft released patches for 1,259 vulnerabilities, including an actively exploited Moderate-severity flaw in Microsoft Outlook (CVE-2026-124194) that allows spoofing and potential exposure of NTLMv2 hashes. An unauthenticated attacker can send a specially crafted message file that, when opened, causes Outlook to connect to an attacker-controlled network location without warning, potentially disclosing authentication credentials. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by November 24, 2026. Other notable vulnerabilities include remote code execution flaws in Windows Search, LDAP, Schannel, and Windows Xbox Live Networking Service, as well as a privilege escalation flaw in Azure OpenAI.

AI-extracted · verify before operational use