It’s another doozy of a Patch Tuesday, with Microsoft fixing 1,094 bugs in its products, including one that attackers exploited before Redmond released a patch. Jake Knott, head of threat intelligence at exposure management firm watchTowr, succinctly said in an email to The Register: “Maybe we should just go home.” “Most security teams haven’t quite recovered from the last month of bumper-to-bumper critical vulnerabilities, emergency patches, and ‘2shell’-branded everything, and we’re yet again at another Patch Tuesday,” Knott told us. Starting with the zero-day: It’s an Outlook spoofing vulnerability, tracked as CVE-2026-124194, and it only garnered a 6.5 out of 10 CVSS rating. But as Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, warns, don’t let the score or the name lull you into thinking it’s OK to put off patching this one. “It’s labeled spoofing, but the impact is bigger than the name suggests,” Childs said in his monthly Patch Tuesday review. “An attacker sends a specially crafted message file and convinces a user to open it,” he wrote. “Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user’s NTLMv2 hash. The attacker can use that hash to authenticate as the user.” Microsoft marked CVE-2026-124194 as exploited, but per usual didn’t say when the attacks started, who is battering this bug, and what they are doing with the access post exploitation. These details will likely start trickling out soon. Plus, now that there’s a public fix, other miscreants are undoubtedly already scanning for vulnerable versions and reverse engineering the patch for their own attack purposes. So prioritize this fix, and keep an eye on your inbox for any suspicious files. Back-to-back months of 1K+ CVEs Despite the second month of more than 1,000 CVEs (October had 1,474), CVE-2026-124194 is the only one under active exploitation, and none of the 1,094 are listed as publicly known. Childs says this shouldn’t give organizations “false comfort.” “Logging back-to-back months above 1,000 CVEs proves automated bug-hunting has permanently reset patch volume,” he told The Register. “With AI making patch-diffing and exploit generation near-instant, the threat window opens the minute these updates drop.” For defenders, this means two things, Childs added. “What defenders need to know and do right now is abandon broad triage and take immediate defensive action: patch Exchange and Domain Controllers (LDAP/Kerberos) first to stop zero-click compromise, ring-fence exposed network services like DNS and DHCP to prevent wormable spread, and verify manual administrative fixes on your cloud services,” he said. Zero-click threats There are two zero-click threats in this month’s batch of fixes: CVE-2026-116928 and CVE-2026-119958. Both are critical, carrying 9.8 CVSS ratings, in part because they don’t require any user interaction to exploit. CVE-2026-116928 is an out-of-bounds write in Microsoft Windows Search Component that could lead to remote code execution. An unauthenticated attacker could abuse this search feature in Exchange “by sending an email containing a specially crafted attachment,” Redmond warned. “Exchange automatically processes the attachment for indexing, so the recipient does not need to open the email or attachment. Successful exploitation could allow the attacker to execute code with the permissions of the affected processing service.” CVE-2026-119958 is an out-of-bounds write vulnerability in Windows' implementation of the Lightweight Directory Access Protocol (LDAP) that could allow unauthenticated attackers to execute code remotely without user interaction. This one can be exploited by sending specially crafted LDAP requests to vulnerable systems, potentially compromising domain controllers. Childs also counts 30 CVEs that pose a “wormable risk,” requiring zero authentication and zero user interaction over a network. All of those are listed in his blog, so prioritize fixing those as well. And…Xbox remote code execution And finally, for funsies, a critical flaw in the Windows Xbox Live Networking Service, CVE-2026-112967, that could allow remote code execution also made this month's roundup. It's a heap-overflow vulnerability with a 9.8 CVSS rating that doesn't require authentication or user interaction to exploit. So don't take a gaming break between testing November's updates. Or, if you do, at least make sure vulnerable Windows systems running the Xbox Live Networking Service are on your patching list, too. ®