Microsoft patched 1,093 flaws, but the one under attack is rated Moderate

Microsoft released its November 2026 Patch Tuesday updates on November 10, fixing 1,093 vulnerabilities across Windows, Office, SQL Server, SharePoint, Exchange Server, Azure services, and developer tools. The severity breakdown: 63 Critical, 1,029 Important, and one Moderate.

That single Moderate flaw is the one attackers are already using.

CVE-2026-124194 is an Outlook spoofing vulnerability with a CVSS score of 6.5. It can leak a user's NTLMv2 authentication hash — the credential material Windows uses to prove identity on a network. Microsoft rates it Moderate. It is the only vulnerability in the release confirmed as exploited in the wild.

Microsoft has not said who is exploiting the flaw, when the attacks began, or how widespread they are. Defenders are patching without that context.

This is the third consecutive month in which the actively exploited bug carried a rating below Critical. The pattern matters more than the headline count. A triage routine that works down the severity list — Critical first, then Important, then Moderate — would leave CVE-2026-124194 untouched while teams chase 63 Criticals that no one is known to be using. Exploit status, not the label, is the better ordering principle.

The volume itself is notable. The 1,093 figure covers Microsoft's own products; counts that include Microsoft Edge (Chromium) flaws reach 1,235, with 66 Critical. By type, the 1,093 break down as 535 Elevation of Privilege, 296 Remote Code Execution, 156 Information Disclosure, 46 Denial of Service, 27 Security Feature Bypass, 22 Spoofing, and 11 Tampering.

Microsoft credits advances in artificial intelligence for helping find and fix bugs at this scale. The company has shipped more than 5,100 security patches so far in 2026.

For security teams, the practical step is straightforward: confirm CVE-2026-124194 is patched on every Outlook endpoint before working through the Critical list. The credential-leak risk is real even at 6.5 — an NTLMv2 hash in the wrong hands is a lateral-movement primitive, not a cosmetic spoofing issue.