Microsoft fixes a record 1,235 security flaws, one already used by hackers

Microsoft released its November 2026 security updates on Tuesday, and one fix is urgent. An Outlook flaw was already being used in real attacks before the fix existed. If someone opens a booby-trapped message file, the attacker can capture information that helps them pose as that person.

What happened

The update fixes 1,235 flaws in total, according to BleepingComputer. Of those, 66 are rated Critical, the most serious level. About 639 are in Windows or Windows components. Another 108 flaws were fixed earlier in the month and are not counted in that total.

Last month's update fixed 1,411 flaws. Huge monthly updates now look routine. BleepingComputer says Microsoft continues to use AI to find and patch vulnerabilities.

How the Outlook attack works

The flaw is tracked as CVE-2026-124194. An attacker sends a specially crafted message file and convinces the person to open it in Outlook. Microsoft says Outlook can then connect to a network location the attacker controls, without showing the usual warning about external content.

When that happens, Windows may try to sign in automatically. That can expose a scrambled form of the user's password, called an NTLM hash. The attacker can try to crack it offline. Recovered credentials could then be used to reach company accounts.

Who it affects

The risk is highest for people and businesses that use Outlook on Windows, especially at work. One stolen login can open the door to email, files and other company systems. Similar tricks have been used before, usually through malicious attachments in phishing emails.

The actively exploited flaw is in Outlook, so people who do not use it are not exposed to that one. The other fixes in this release still matter for every Windows PC.

What to do

The alert box above lists the steps. The short version: update every PC, restart when asked, and treat unexpected message files with suspicion, even from names you know. Business owners should also ask their IT provider to confirm the update is installed.

What happens next

The material does not say how many people were targeted, who is behind the attacks, or how widely the flaw was used. Microsoft says exploitation needs the user to take an action, which is why caution with attachments remains the best defense after updating.