November’s security updates call for risk based triage: an Outlook flaw is already under attack, while several Microsoft server vulnerabilities carry serious exposure for organizations running affected services. SAP’s ICM2Shell flaws add a separate concern, with researchers demonstrating unauthenticated remote code execution. The practical priority is to identify which affected systems are reachable in each environment, then patch or mitigate those first.
Outlook flaw exposes NTLM hashes
Microsoft fixed 1,094 vulnerabilities this month, including CVE-2026-124194, a zero-day affecting Outlook that attackers are exploiting to obtain users’ NTLMv2 password hashes. Its CVSS score is 6.5, but the active exploitation makes that rating a poor guide to urgency. “Don’t let the low score fool you,” said Nick Carroll, cyber incident response manager at Nightwing.
The flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. An attack requires a user to open a malicious Office file. That action can cause Outlook to connect to an attacker-controlled network location without showing its usual warning about external content, potentially exposing the user’s authentication data.
A stolen hash may let an attacker attempt to authenticate to other systems by relaying it, or try to recover the underlying password through cracking. Until affected software is patched, organizations can reduce exposure by reinforcing caution around unexpected Office files and using email gateways that block malicious attachments.
Microsoft credited an Anthropic researcher using the Claude AI assistant with finding the vulnerability. The discovery stands out amid Microsoft’s use of AI models to identify vulnerabilities in its products since the summer. “For most of the year, AI has been building bigger haystacks across Patch Tuesday releases, and this appears to be the first time it has found a needle,” said Satyam Narang, senior staff researcher at Tenable.
Prioritize exposed Microsoft services
Of Microsoft’s 1,094 fixes, 63 address vulnerabilities rated critical. Four have CVSS scores of 9.8, according to Jack Bicer, director of vulnerability research at Action1. Three of those can be exploited without credentials or user interaction, putting network exposed services near the top of many administrators’ patch queues.
CVE-2026-119958 affects Windows LDAP and could let an unauthenticated attacker execute code in the LDAP service. Domain controllers are a particular concern: compromise there could put an organization’s Active Directory environment at risk. CVE-2026-118207 affects Microsoft Exchange Server and can be triggered by an attacker able to send email to the organization. CVE-2026-112967 affects Windows Xbox Live Networking Service; an attacker on the same network could gain full control of a Windows system.
The fourth 9.8-rated issue, CVE-2026-119990, is an elevation-of-privilege vulnerability in Azure OpenAI. Microsoft patches this cloud service automatically, so organizations should check the service’s status and any instructions that apply to their use of it.
Bicer’s suggested order follows exposure: address domain controllers and Exchange servers first, then systems exposing IIS, Microsoft Secure Channel (Schannel) or RPC to untrusted networks. Message Queuing also warrants an inventory. Administrators should locate servers with the service enabled, disable it where applications don’t require it, and patch the remaining instances promptly. Hypervisor hosts need planned maintenance as well, since a compromised host could affect every tenant running on it.
Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, urged defenders to replace broad triage with immediate action. He recommended prioritizing Exchange and domain controllers, containing exposed network services such as DNS and DHCP to limit the chance of worm like spread, and checking whether cloud services require manual administrative fixes.
The large patch count is context, not a deployment plan. Tyler Reguly, associate director of security R&D at Fortra, said Microsoft fixed fewer vulnerabilities this month than in October, but cautioned against treating one month’s decline as a trend. He expects elevated counts to continue while previously hidden flaws are surfaced and fixed, with numbers eventually falling as that backlog shrinks.
Reguly also advised security leaders to keep prioritization tied to their own inventories and processes. A vulnerability matters to an organization when it affects software that organization actually runs. System hardening and mitigation can reduce exposure while teams work through patches; the most useful next step is to map fixes to deployed products and reachable services.
SAP ICM2Shell enables unauthenticated code execution
SAP has fixed two critical vulnerabilities known collectively as ICM2Shell: CVE-2026-76964 and CVE-2026-89126. The flaws affect how the SAP Kernel handles WebSocket traffic in the Internet Communications Manager (ICM) and SAP Web Dispatcher, a reverse proxy commonly placed at the network edge. Onapsis researchers who found the issues supplied SAP with a working exploit that executes arbitrary commands remotely without authentication.
An attacker needs network access to the HTTP or HTTPS port. WebSocket support is enabled by default in both ICM and SAP Web Dispatcher, so exposure can exist even when applications don’t use WebSocket. Some services, including default ICF services in SAP S/4HANA, accept WebSocket connections without authentication; in other cases, the flaw is reachable before authentication occurs.
The researchers also reproduced a denial of service across every SAP Kernel release they tested. Successful code execution runs commands as the adm account, which owns the SAP installation and its executables, instance profiles, secure store and database connection. Access at that level could expose database credentials and other secrets, enable access to connected SAP and non-SAP systems, allow persistent changes to software or configuration, or destroy data. Organizations should identify reachable ICM and Web Dispatcher instances and apply SAP’s fixes.
Browser and application updates add to the work
Adobe issued nine security bulletins addressing 110 CVEs, including 22 rated critical. Adobe said it was not aware of in-the-wild exploitation. Among the updates, Connect bulletin APSB26-191 fixes 24 CVEs, 18 critical and six rated CVSS 10.0. The issues include server-side request forgery, path traversal and SQL injection, and affect Windows on-premises versions 12.12 and earlier. Experience Manager bulletin APSB26-189 addresses 14 CVEs, including four critical code execution flaws rated CVSS 9.9.
Google’s Chrome 157.0.8103.50 release fixes nine CVEs, including CVE-2026-125350, which is being exploited in the wild. It is Chrome’s eighth exploited zero-day of 2026, according to Chris Goettl, Ivanti’s vice president of product management. Chromium based browsers such as Microsoft Edge also need the fix, and users must relaunch after updating for it to take effect.
The Chrome update follows the November 3 release of version 157, which addressed 213 vulnerabilities, seven rated critical. Google’s November Android bulletin fixes 216 vulnerabilities, including 23 critical issues; none were marked as exploited. Devices should be on Android patch level 2026-11-05 or later.
Mozilla’s November 10 releases cover Firefox 160, Firefox ESR 153.7 and ESR 115.45, fixing 99, 81 and 28 vulnerabilities respectively. Fifty-seven Firefox 160 issues, 51 ESR 153.7 issues and all 28 ESR 115.45 issues are rated High. Many involve use-after-free or memory boundary problems in graphics, DOM, layout and JavaScript components. The updates also address sandbox escapes, including CVE-2026-124907, a CanvasWebGL use-after-free flaw that enables privilege escalation and sandbox escape. Thunderbird 160 and 153.7 include the same fix.
For security teams, the workload spans actively exploited client software, high impact Windows infrastructure and exposed SAP services. A current inventory of affected products and network access paths will help turn a long list of fixes into a focused deployment sequence.
