AW Dev Rethought Flash: Microsoft Fixed 1,093 Flaws. The Exploited One Is Rated Moderate.

Microsoft’s November Patch Tuesday landed on the 10th with 1,093 newly disclosed vulnerabilities — 63 Critical, 1,029 Important, and one Moderate.

Exactly one of them is being exploited in the wild. It’s the Moderate.

CVE-2026-124194 carries a CVSS score of 6.5. It sits beneath sixty-three Critical flaws that, as far as anyone can tell, nobody is attacking. If your patching queue is sorted by severity — and most are — this is the last thing you’ll get to.

The One That’s Being Used

It’s an Outlook spoofing flaw, and the mechanism is quiet enough that a user won’t notice it working.

An unauthenticated attacker sends a crafted message file. When the recipient opens it, Outlook reaches out to an attacker-controlled network location without displaying the external-content warning it would normally show. That outbound connection leaks the user’s NTLMv2 hash.

The hash is the payload. It can be relayed to authenticate as that user against other services, or taken offline and cracked at leisure. No malware is dropped, no obvious failure occurs, and the user sees a message that didn’t render quite right.

Two details worth getting correct. The Preview Pane is not an attack vector, so this requires the recipient to actually open the file — which narrows it meaningfully. And the affected products are 32- and 64-bit Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise.

Microsoft confirms attacks have occurred but has named no attackers, no victims and no scale.

Why a 6.5 Beats a 9.8 This Week

CVSS scores what a vulnerability makes possible under ideal conditions for an attacker. It has nothing to say about whether exploitation is practical, whether an exploit exists, or whether anybody has written one.

CVSS measures how bad a vulnerability could be. It says nothing about whether anyone has bothered.

A Critical RCE in a service you don’t expose, in a configuration you don’t run, requiring an attacker position they don’t have, scores 9.8 and will likely never be touched. A Moderate credential leak in the mail client every employee opens a hundred times a day is being used right now.

This is why CISA’s Known Exploited Vulnerabilities catalogue exists as a separate thing from severity scoring. Exploitation is an empirical fact about the world. Severity is a model of a hypothetical.

If your remediation SLA is defined purely by CVSS band — Critical in 7 days, High in 30, Moderate in 90 — then this month your policy actively instructs you to fix the dangerous one last. Worth checking whether yours does.

What Else Is in the Batch

Forty-eight of the 63 Criticals are remote code execution, fifteen are privilege escalation.

Office is heavily represented. Excel has 12 Critical fixes, Word has 4, PowerPoint 1. Outlook has three Critical RCEs of its own — CVE-2026-111309, CVE-2026-110068 and CVE-2026-110043 — none currently marked as exploited. These matter because people open these file types without thinking, which is the whole delivery problem.

Hyper-V has eight Critical privilege escalations, which is the one to look at if you run virtualisation hosts. Guest-to-host boundaries are the thing that makes multi-tenant anything work.

Message Queuing has five Critical RCEs. MSMQ is frequently enabled by a dependency nobody remembers choosing.

Network-reachable Criticals cover the SMB Server transport driver (CVE-2026-113825), TCP/IP (CVE-2026-113859), Exchange Server (CVE-2026-118207) and LDAP (CVE-2026-119958).

And in the cloud estate: Azure OpenAI privilege escalation (CVE-2026-119990), Azure Managed Grafana privilege escalation (CVE-2026-114160), and a Microsoft Defender RCE (CVE-2026-122194) — a vulnerability in the thing you installed to find vulnerabilities.

About That Number

A thousand-plus vulnerabilities in one monthly release would have been inconceivable a few years ago. Microsoft’s annual totals have been climbing steeply, and this is not because the code got worse.

Finding bugs got cheaper. Fuzzing at scale, automated static analysis, and increasingly machine-assisted vulnerability research have all pushed discovery costs down, and discovery costs were the constraint. OpenAI published work this month producing hundreds of working kernel exploits at roughly $1,280 each — a price per vulnerability, which is a category of number that didn’t previously exist.

The supply of known flaws is rising fast. The capacity to triage, test and deploy fixes is not rising at the same rate, because that part still runs at the speed of change windows and regression testing.

The bottleneck moved from finding vulnerabilities to deciding which ones matter to you.

Which loops directly back to the first problem. When one release contains 1,093 items, the ordering of your queue stops being administrative detail and becomes the entire security outcome.

What To Do This Week

Patch CVE-2026-124194 first, ahead of everything else in the batch, on Office LTSC 2021, Office LTSC 2024 and Microsoft 365 Apps. It’s the only one with confirmed attacks, regardless of what the score says.

While you’re there, consider blocking outbound SMB and NTLM authentication to external destinations at the network edge if you haven’t. That mitigates this entire class of hash-leak attack, not just this instance.

Then the Office RCEs — Excel, Word, PowerPoint, Outlook — since those file types arrive by email all day and users open them.

Then the network-reachable Criticals: SMB, TCP/IP, Exchange, LDAP, Message Queuing. Anything an attacker can reach without already being inside.

Then Hyper-V on virtualisation hosts, and the Defender and Azure fixes.

And one structural thing worth doing once rather than monthly: if your patch SLA is driven by CVSS band alone, add a rule that anything on CISA’s KEV catalogue jumps the queue regardless of score. This month is a clean demonstration of why — and next month it’ll be a different Moderate.