November 2026 Patch Tuesday: 63 Critical Microsoft fixes, plus an Outlook zero day that allows theft of hashed credentials

Summary

Microsoft's November Patch Tuesday fixed 1,094 vulnerabilities, 63 of them rated critical. An Outlook zero-day, CVE-2026-124194 (CVSS 6.5), is already being exploited and can let an attacker obtain a user's NTLMv2 password hash when that user opens a malicious Office file. Anthropic's Claude AI assistant was credited for finding the Outlook flaw.

Mitigation

Patch order should follow reach, not product names: domain controllers and Exchange servers first, then anything exposing IIS, Schannel or RPC to untrusted networks. Message Queuing servers should be inventoried, the service disabled where no application needs it, and the rest patched the same day. Until the Outlook patch is installed, good employee cybersecurity awareness training and an effective email gateway could mitigate the attack.

Related items

• InfoBenchmarking Endor Labs AI SAST: 2.6x more real vulnerabilities found than frontier models | Endor LabsSame vendor · Endor Labs Blog
• MediumEndor Labs’ AI SAST Finds Zero Day Memory-Amplification DoS in Anthropic’s buffa library | Endor LabsSame vendor · Endor Labs Blog
• InfoAnthropic opens Australian retail IPO offering as AI scrutiny intensifies Same vendor · CNBC Technology
• InfoJim Cramer says Anthropic's explosive growth could justify a record-breaking IPOSame vendor · CNBC Technology
• MediumDetecting sleeper agents hiding in AI model neuronsSame vendor · Microsoft Security Blog