Microsoft’s November 10, 2026, Patch Tuesday security release addresses approximately 1,090 vulnerabilities across Windows, Office, Exchange, Azure, and other Microsoft products. The most urgent issue is an actively exploited Outlook spoofing vulnerability that could expose NTLMv2 authentication hashes when users open malicious message files. Researchers also identified 30 vulnerabilities with potentially wormable attack characteristics, raising concerns about remote code execution, credential theft, and attacks targeting enterprise infrastructure.
CRITICAL CVES TARGET OUTLOOK, EXCHANGE, AND WINDOWS SERVICES
Several vulnerabilities require immediate attention because of their potential impact on authentication systems, messaging servers, and network services:
- CVE-2026-124194 (CVSS 6.5): Actively exploited Outlook spoofing vulnerability that could expose NTLMv2 hashes through malicious message files.
- CVE-2026-116928 (CVSS 9.8): Windows Search remote code execution vulnerability that could be triggered when Exchange automatically indexes a malicious attachment without user interaction.
- CVE-2026-119958 (CVSS 9.8): Windows LDAP vulnerability allowing unauthenticated attackers to potentially execute malicious code through specially crafted network requests.
- CVE-2026-119952: Windows Schannel remote code execution vulnerability affecting secure network communications and authentication services.
- CVE-2026-119990 (CVSS 9.8): Azure OpenAI elevation-of-privilege vulnerability that could expose orchestration information or permit unauthorized workflow modifications.
THIRTY VULNERABILITIES RAISE WORMABLE ATTACK CONCERNS
Trend Micro’s Zero Day Initiative identified 30 vulnerabilities exhibiting characteristics associated with worm-like attacks, including 17 that could potentially allow unauthenticated remote code execution without user interaction. Affected components include Exchange, LDAP, Schannel, DNS, DHCP, SMB Server, Internet Information Services, and Windows Message Queuing. Although these vulnerabilities are not confirmed as practically wormable, their potential to affect network-facing services makes them particularly concerning for enterprise environments. Microsoft has confirmed active exploitation of the Outlook vulnerability, but the highlighted Windows Search, LDAP, Schannel, and Azure OpenAI flaws have not been publicly confirmed as exploited.
ORGANIZATIONS URGED TO PRIORITIZE SECURITY PATCHES
Security teams should prioritize updating Outlook, Microsoft 365, Exchange, domain controllers, and other critical Windows services. Administrators should restrict outbound SMB and NTLM authentication, investigate suspicious authentication attempts, enforce SMB signing where supported, and monitor for potential credential relay activity. Azure OpenAI customers should review Microsoft’s guidance for required customer actions related to CVE-2026-119990. Organizations should also accelerate patch testing and deployment based on system exposure and business impact, particularly for vulnerabilities that could enable unauthenticated remote attacks.