Microsoft Patches 1,093 Flaws, Including Outlook Zero-Day Found With Claude

Microsoft shipped fixes for 1,093 security vulnerabilities on Tuesday, its second consecutive month above 1,000, and the single actively exploited bug in the batch — an Outlook flaw that leaks a user's NTLMv2 password hash — was found in part by a researcher working with Anthropic's Claude. The advisory credits "Benoît Sevens using Claude with Anthropic" alongside a researcher who goes by nono. That acknowledgment, and the sheer size of the release, mark a shift in how software gets secured and attacked. Tenable noted the advisory does not name which Claude version was used — a gap worth remembering before crediting the model itself.

The scale has changed fast. A year ago, Microsoft's November release carried 63 new CVEs assigned by the company, according to its own update data; this month's carried more than 17 times as many. The peak came in October, when Microsoft published more than 1,400 CVEs in a single day. Researchers attribute the growth to AI-assisted bug hunting.

Tenable's Satnam Narang told CSO Online: "for most of the year, AI has been building bigger haystacks across Patch Tuesday releases, and this appears to be the first time it has found a needle." That framing carries a caveat: finding a needle once does not prove the tool finds them reliably.

What does November's release contain?

Tenable's breakdown shows the numbers:

• 63 critical flaws
• 1,029 important flaws
• 1 moderate flaw
• Elevation-of-privilege bugs: 48.9% of the total
• Remote code execution bugs: 27.1%

The release pushed Microsoft past 5,160 disclosed vulnerabilities this year, Narang noted in comments reported by The Record, with the December update still due on Dec. 8. The obvious stakes: enterprise patch teams now face monthly workloads an order of magnitude larger than a year ago, with no sign of retreat.

How dangerous is the Outlook zero-day?

The exploited flaw, CVE-2026-124194, is the lone moderate-rated bug in the batch. It carries a CVSS score of 6.5 (a 0-to-10 severity metric) and Microsoft labels it a spoofing vulnerability. An attacker sends a crafted message file and persuades the target to open it. Outlook then connects to an attacker-controlled network location "without displaying the usual external-content warning," Microsoft said, and gives up the user's NTLMv2 hash (a hashed form of Windows authentication credentials). The attacker "could use this to authenticate as the user."

The Preview Pane is not an attack vector. Fixes cover Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Microsoft has not said who is exploiting the bug or against whom — a silence that limits how much defenders can infer about the campaign behind it.

Dustin Childs, head of threat awareness at the Zero Day Initiative, wrote in his monthly review that "the impact is bigger than the name suggests" and warned readers not to let the low score lull them. The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog the same day and gave federal civilian agencies until Nov. 24 to patch. In plain words: the rating understates the practical risk, and the deadline is two weeks.

Which unexploited bugs should come first?

The unexploited flaws are the bigger scheduling problem. Two critical remote code execution vulnerabilities score 9.8 and need no user interaction:

• CVE-2026-116928, a Windows Search flaw
• CVE-2026-119958, a Windows LDAP flaw

Both are out-of-bounds writes (a memory-safety error) that Microsoft says let an unauthorized attacker execute code over a network. Microsoft rates both "exploitation less likely" — though that rating is a probability judgment, not a guarantee.

Microsoft rates two other bugs as "exploitation more likely": the critical Exchange Server flaw CVE-2026-118207 and the Active Directory Domain Services flaw CVE-2026-118146, each scored 8.8. Childs counts 30 CVEs this month that he considers wormable (capable of self-propagating between machines). His advice to The Register was to "patch Exchange and Domain Controllers (LDAP/Kerberos) first to stop zero-click compromise." The takeaway: severity scores alone misdirect effort; the "more likely" ratings and wormability matter more.

Childs also made a point about the broader picture: seeing fewer zero-days exploited in the wild "makes sense, as AI is better at reversing patches than it is at finding and exploiting bugs in closed-source software." WebProNews has separately reported on how AI helps attackers work faster against fresh patches. In short, the same tooling that fills these releases also shortens the window between a patch's release and working exploits.

Is Microsoft changing NTLM itself?

Yes, and in a way that directly addresses the protocol the Outlook bug exposes. The Windows 11 security update KB5132061 enables clients to offer NTLM message signing by default for non-anonymous connections. Microsoft said the change "helps reduce exposure to NTLM relay attacks," in which an attacker intercepts and forwards authentication traffic. One caveat: enabling signing by default reduces relay exposure but does not remove the credential-leak path the Outlook bug creates; the patch for CVE-2026-124194 remains necessary.

Why won't the counts go back down?

Childs doesn't expect them to. "Logging back-to-back months above 1,000 CVEs proves automated bug-hunting has permanently reset patch volume," he told The Register. "With AI making patch-diffing and exploit generation near-instant, the threat window opens the minute these updates drop." Patch-diffing means analyzing a patch to reconstruct the flaw it fixes — a step attackers now automate.

The trajectory in Microsoft's own data is unambiguous: 63 Microsoft-assigned CVEs in November 2025, 571 in July 2026, 972 in September, 1,408 in October, and 1,093 in November. For defenders, the December update on Dec. 8 will test whether the new baseline holds — and whether Claude's credited discovery turns out to be a one-off or the start of a pattern in Microsoft's advisories.