What Happened
Microsoft’s November 2026 Patch Tuesday fixed a record 1,235 vulnerabilities, BleepingComputer reports. Sixty-six are rated Critical. One is under active attack. CVE-2026-124194 is an Outlook spoofing flaw. A crafted message file, once opened, makes Outlook connect to an attacker server without the usual external content warning. Attackers use it to steal NTLM hashes, crack them offline, and sign in to corporate accounts.
The critical list also includes remote code execution in Active Directory Domain Services, Exchange Server, Office, Graphic Fonts, and Microsoft Defender.
Why This Matters for Canadian Organizations
Outlook is the default mail client across federal departments, provinces, hospitals, banks, and most Canadian businesses. Many still run hybrid Exchange and on-premises Active Directory. A stolen NTLM hash from one user becomes a foothold into the domain.
The volume is the second problem. More than 1,200 fixes in one month strains every patch team. Smaller organizations and municipalities often patch on a monthly cycle with limited staff. Attackers know the window between release and deployment. A breach starting from stolen credentials still carries PIPEDA reporting obligations, and Quebec organizations face Law 25 duties too.
What to Do
Patch Outlook and Office first, then Exchange Server and domain controllers. Block outbound SMB on TCP 445 at the perimeter to stop Outlook from sending hashes to outside servers. Add privileged accounts to the Protected Users group. Audit NTLM use and plan to restrict it where Kerberos works. Warn staff about unexpected message attachments this week. Watch for unusual sign-ins from accounts where users opened suspicious mail. Read more TechTalk coverage and our latest news.
