Microsoft's November update fixes over a thousand flaws. The one already being used is rated only Moderate
Count them however you like, it's a big month. BleepingComputer puts Tuesday's Microsoft update at 1,235 fixed flaws, Tenable at 1,093, and Dustin Childs of the Zero Day Initiative settles for "about 1,090" while admitting the count is "a bit confusing". Whichever number you pick, it's smaller than October's record and bigger than any month before that.
Only one of those flaws was being used by attackers before the fix arrived, and it's an odd one to top the list. CVE-2026-124194 lives in Outlook, scores 6.5 out of 10, and Microsoft rates it merely Moderate. Someone sends you a specially built message file and talks you into opening it. Outlook then quietly contacts a computer the attacker controls, without the usual warning about external content, and in doing so hands over what's called an NTLMv2 hash. Think of it as a scrambled copy of your Windows sign-in password. It can be used to pose as you on a work network, and a weak password can be worked out from it at leisure.
Two details are reassuring. Seeing the message in the preview pane doesn't trigger anything, according to Childs; you have to open the file. And Microsoft says the attack needs "user interaction", which in plain terms means the old rule about unexpected attachments still does its job. His verdict on the low score, though: "Microsoft marks it as exploited, so this one goes to the top of the list." Tenable adds that the researcher credited with finding the bug used Claude, Anthropic's AI model, to do it, which goes some way to explaining why these monthly totals have ballooned.
On Windows 11 the fixes arrive as KB5132061 or KB5131087, depending on your version, and on Windows 10 PCs enrolled in extended updates as KB5131096. Open Settings, Windows Update, and install what's waiting. Then open Word, choose File, Account, Update Options and Update Now, because Office keeps its own update schedule. If Windows Update keeps failing instead of finishing, that's the situation Tendvane's Windows Update repair wizard is there for.