Microsoft has fixed Outlook sign-in and mail delivery issues on Exchange Server systems after installing the October 2026 Windows Server security updates. Microsoft acknowledged this known issue in mid-October, confirming that users had trouble accessing email or signing in to Outlook after installing the latest updates on systems running Windows Server 2019 and later. As explained at the time, the sign-in and mail flow issues are caused by a new default limit on the amount of memory Endpoint Mapper uses when handling Endpoint Lookup calls, introduced by the October 2026 updates. "After installing the October 2026 Windows security update [..], some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication," Microsoft said at the time.
Microsoft November Patch Tuesday security updates fix 1,090 flaws, including one exploited Outlook bug and 30 potentially wormable issues. Microsoft November Patch Tuesday addressed about 1,090 new vulnerabilities, which is less than the roughly 1,400 last month. Two months in a row now exceed every previous year from Microsoft, and the overall count is a bit confusing, so other trackers report different totals. The release covers Windows and its components, Office, networking and remote access, graphics, media and printing, storage and file systems, .NET and Visual Studio, security and identity, Azure and cloud, Exchange Server, Dynamics and Xbox. Only one bug is under active attack and none is publicly known. ZDI says that doesn’t mean less exploitation, only fewer zero-days, and it guesses that AI is better at reversing patches than at finding and exploiting bugs in closed-source software. The exploited bug is CVE-2026-124194, an Outlook spoofing flaw, and its name undersells the impact. An attacker sends a crafted message file and talks the user into opening it, and Outlook connects to an attacker-controlled location without the usual external-content warning, which leaks the user’s NTLMv2 hash. “An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Exploitation requires network connectivity and user interaction.” reads the advisory. “An attacker must send a user a malicious Office file and convince them to open it.” The attacker can then authenticate as that user. The Preview Pane isn’t an attack path and the CVSS score is only 6.5, but ZDI says to put it first because Microsoft marks it as exploited. CVE-2026-116928 is a Windows Search remote code execution bug reached through Exchange Server. An unauthenticated attacker emails a crafted attachment, and the bug triggers when the server indexes it automatically, so the recipient never opens anything. It’s zero-click, scores CVSS 9.8, and ZDI rates it more severe than any of the nine patches Exchange gets this month. CVE-2026-119958 hits the Windows LDAP service. An unauthenticated attacker sends crafted LDAP calls over the network, triggers an out-of-bounds write and runs code in the service context, which could be destructive on domain controllers. ZDI says to test and deploy it quickly. CVE-2026-119952, a Schannel remote code execution flaw, is marked “Exploitation More Likely”, one of only a few Critical patches with that rating, and its high attack complexity is why the score is lower. CVE-2026-119990, an Azure OpenAI elevation of privilege bug, got a bulletin that said “Customer Action Required: Yes” and then listed nothing to do. An unauthenticated attacker could send a crafted request over the internet and reach orchestration information, change workflows or disrupt the service. Microsoft has since revised it to say no customer action is needed. A bulletin that says action required and lists none is the most relaxed urgent notice you’ll read this month. Two more stand out for their components. CVE-2026-95962 is a use-after-free in the little-documented Windows Virtual Filtering Platform, reachable with a crafted network packet and needing no authentication or user interaction. It involves a race condition, but ZDI notes those get beaten all the time at Pwn2Own. CVE-2026-112967 is a heap overflow in the Xbox Live Networking Service with a CVSS of 9.8, and ZDI doesn’t think exploitation is likely but enjoys imagining Xbox Live exploits in the wild. ZDI counts 30 wormable bugs this month, down from 59 last month. Seventeen carry advisory wording about an unauthenticated attacker running code over the network with no interaction, and 13 use variant wording or have no FAQ but show the same pattern in their summaries and CVSS vectors. ZDI warns it may be wrong on some, since a few advisories are light on detail. ComponentCVEsMessage Queuing (5)CVE-2026-116710, 119963, 119964, 109459, 119967DNS (4)CVE-2026-81384, 96092, 96177, 88218Color Management (2)CVE-2026-96067, 96078DHCP Server (2)CVE-2026-88243, 72998DirectMusic (2)CVE-2026-95882, 95901Xbox (2)CVE-2026-112967, 66801One each (13)Exchange Server (116928), LDAP (119958), Schannel (119952), CredSSP (119962), Deployment Services (119951), IIS (119961), NAT (113862), RPC Runtime (118737), Media Foundation (96157), iSCSI (88234), Virtual Filtering Platform (95962), eSCL Scanner (95956), Modern Device Management (119945) Network-facing services like DNS, DHCP, LDAP and Exchange deserve the earliest attention. “I may be wrong about some of these, since a few advisories are light on detail.” concludes ZDI. “As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Patch Tuesday)
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-2026-108186 (CVSS score: 9.6) - An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via
Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments. "In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against
Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes. The activity has been found to share some
Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant. Most of the open apps were games, landing pages, and calculators, but about 1 in 10 contained internal business or
The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys. Each intermediate CA has its own private key, which the company uses to sign the certificates it issues. The 8 intermediate CAs compromised in October had a different problem: a single line in the script
Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers.
AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them. The company builds and runs apps for its customers and stores their secrets, such as API keys and database
An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights. The team tested the method on
Confirm this action.
Leaving now will discard your changes.