Microsoft has issued updates to fix over 1200 vulnerabilities in its products, a new record.
The tech giant’s November Patch Tuesday contained fixes for 1235 flaws, including one zero-day being actively exploited in the wild.
It makes this month the fourth this year in which Microsoft has issued a record number of patches, following previous milestones passed in July, September and October.
The zero-day vulnerability is CVE-2026-124194, a spoofing bug in Microsoft Outlook, exploited in attacks to steal NTLM account hashes.
“An attacker sends a specially crafted message file and gets the user to open it. Outlook then connects to a network location the attacker controls, but it skips the usual warning about external content,” explained Action1 director of vulnerability research, Jack Bicer.
“That quiet connection can leak the user's NTLMv2 hash, a scrambled form of their login secret, which the attacker can use to sign in as that person. It affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.”
Read more on patching: Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds
Although the zero-day is rated “moderate,” sysadmins should prioritize it, Bicer advised.
“Attackers are already exploiting it, it needs only one click on an email file, and it hits Outlook, which nearly every organization runs,” he added. “A stolen hash can open doors far beyond the inbox. Push the Office update to every Outlook user now, starting with administrators and high-value accounts.”
The majority (536) of CVEs patched this month are elevation of privilege (EoP), followed by remote code execution (296) and information disclosure (157).
A total of 66 are rated critical, most of these being remote code execution flaws.
SAP Patch Volumes Hit New Highs
Microsoft wasn’t the only software giant to release a record-breaking number of security updates yesterday. SAP’s November Patch Day was the biggest ever, with 43 vulnerabilities addressed, including 12 Hot News Notes and 13 High Priority.
“Hot News” is the highest priority ranking given to SAP security updates (Notes).
The patch load was twice the size of the average for 2026 and included four with a maximum CVSS score of 10.0, according to Onapsis.
These were:
- CVE-2026-89103 (SAP Security Note #3798345), a broken access control vulnerability in SAP Gateway dubbed “ProxyGate”
- CVE-2026-76964 (SAP Security Note #3778530), a memory corruption flaw in SAP NetWeaver AS ABAP (Internet Communication Manager)
- CVE-2026-89126 (SAP Security Note #3778556), a memory corruption vulnerability in SAP Web Dispatcher
- CVE-2026-120017 (SAP Security Note #3849308), a missing authentication (SAML2 authentication bypass) vulnerability in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)