Overview
- On Nov. 10 Microsoft released Patch Tuesday updates that remedied 1,093 newly reported vulnerabilities across Windows, Office, Exchange and other products, including 63 rated critical and 48 remote code execution flaws.
- Security researchers observed active exploitation of an Outlook vulnerability (CVE-2026-124194) that can make Outlook connect to an attacker server and leak NTLMv2 authentication hashes, and Microsoft has issued an Outlook update while CISA added the flaw to its known-exploited list.
- A separate critical remote-code-execution bug in the Windows Search component (CVE-2026-116928) can be triggered via a specially crafted email processed by Exchange’s indexer, letting attackers run code without any user opening the message.
- Edge received a distinct Chromium security update that fixes 213 vulnerabilities and is tracked separately from Microsoft’s 1,093-vulnerability tally.
- Microsoft and U.S. and industry security vendors urge administrators to enable updates, prioritize Exchange- and Windows Search–related patches using Microsoft’s recommended risk cohorts, and act quickly because several RCEs could allow rapid lateral spread or credential-based impersonation if left unpatched.