Microsoft’s November Patch Tuesday delivered fixes for 1,094 bugs, but only one is known to have been exploited in the wild: an Outlook spoofing flaw tracked as CVE-2026-124194. The vulnerability lets an attacker send a crafted message file that, when opened, causes Outlook to connect to an attacker-controlled location without the usual external-content warning, leaking the user’s NTLMv2 hash for authentication. TrendAI’s Dustin Childs warns the modest 6.5 CVSS score should not lull anyone into delay, and urges immediate deployment of the fix. The month also included two critical zero-click bugs—CVE-2026-116928 in Windows Search and CVE-2026-119958 in LDAP—both rated 9.8, plus a critical Xbox Live Networking Service flaw (CVE-2026-112967). Childs recommends prioritising Exchange, Domain Controllers, DNS, DHCP and cloud-service fixes, and watching for suspicious inbox files. 1