Microsoft has fixed Outlook sign-in and mail delivery issues on Exchange Server systems after installing the October 2026 Windows Server security updates. Microsoft acknowledged this known issue in mid-October, confirming that users had trouble accessing email or signing in to Outlook after installing the latest updates on systems running Windows Server 2019 and later. As explained at the time, the sign-in and mail flow issues are caused by a new default limit on the amount of memory Endpoint Mapper uses when handling Endpoint Lookup calls, introduced by the October 2026 updates. "After installing the October 2026 Windows security update [..], some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication," Microsoft said at the time.
Microsoft November Patch Tuesday security updates fix 1,090 flaws, including one exploited Outlook bug and 30 potentially wormable issues. Microsoft November Patch Tuesday addressed about 1,090 new vulnerabilities, which is less than the roughly 1,400 last month. Two months in a row now exceed every previous year from Microsoft, and the overall count is a bit confusing, so other trackers report different totals. The release covers Windows and its components, Office, networking and remote access, graphics, media and printing, storage and file systems, .NET and Visual Studio, security and identity, Azure and cloud, Exchange Server, Dynamics and Xbox. Only one bug is under active attack and none is publicly known. ZDI says that doesn’t mean less exploitation, only fewer zero-days, and it guesses that AI is better at reversing patches than at finding and exploiting bugs in closed-source software. The exploited bug is CVE-2026-124194, an Outlook spoofing flaw, and its name undersells the impact. An attacker sends a crafted message file and talks the user into opening it, and Outlook connects to an attacker-controlled location without the usual external-content warning, which leaks the user’s NTLMv2 hash. “An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Exploitation requires network connectivity and user interaction.” reads the advisory. “An attacker must send a user a malicious Office file and convince them to open it.” The attacker can then authenticate as that user. The Preview Pane isn’t an attack path and the CVSS score is only 6.5, but ZDI says to put it first because Microsoft marks it as exploited. CVE-2026-116928 is a Windows Search remote code execution bug reached through Exchange Server. An unauthenticated attacker emails a crafted attachment, and the bug triggers when the server indexes it automatically, so the recipient never opens anything. It’s zero-click, scores CVSS 9.8, and ZDI rates it more severe than any of the nine patches Exchange gets this month. CVE-2026-119958 hits the Windows LDAP service. An unauthenticated attacker sends crafted LDAP calls over the network, triggers an out-of-bounds write and runs code in the service context, which could be destructive on domain controllers. ZDI says to test and deploy it quickly. CVE-2026-119952, a Schannel remote code execution flaw, is marked “Exploitation More Likely”, one of only a few Critical patches with that rating, and its high attack complexity is why the score is lower. CVE-2026-119990, an Azure OpenAI elevation of privilege bug, got a bulletin that said “Customer Action Required: Yes” and then listed nothing to do. An unauthenticated attacker could send a crafted request over the internet and reach orchestration information, change workflows or disrupt the service. Microsoft has since revised it to say no customer action is needed. A bulletin that says action required and lists none is the most relaxed urgent notice you’ll read this month. Two more stand out for their components. CVE-2026-95962 is a use-after-free in the little-documented Windows Virtual Filtering Platform, reachable with a crafted network packet and needing no authentication or user interaction. It involves a race condition, but ZDI notes those get beaten all the time at Pwn2Own. CVE-2026-112967 is a heap overflow in the Xbox Live Networking Service with a CVSS of 9.8, and ZDI doesn’t think exploitation is likely but enjoys imagining Xbox Live exploits in the wild. ZDI counts 30 wormable bugs this month, down from 59 last month. Seventeen carry advisory wording about an unauthenticated attacker running code over the network with no interaction, and 13 use variant wording or have no FAQ but show the same pattern in their summaries and CVSS vectors. ZDI warns it may be wrong on some, since a few advisories are light on detail. ComponentCVEsMessage Queuing (5)CVE-2026-116710, 119963, 119964, 109459, 119967DNS (4)CVE-2026-81384, 96092, 96177, 88218Color Management (2)CVE-2026-96067, 96078DHCP Server (2)CVE-2026-88243, 72998DirectMusic (2)CVE-2026-95882, 95901Xbox (2)CVE-2026-112967, 66801One each (13)Exchange Server (116928), LDAP (119958), Schannel (119952), CredSSP (119962), Deployment Services (119951), IIS (119961), NAT (113862), RPC Runtime (118737), Media Foundation (96157), iSCSI (88234), Virtual Filtering Platform (95962), eSCL Scanner (95956), Modern Device Management (119945) Network-facing services like DNS, DHCP, LDAP and Exchange deserve the earliest attention. “I may be wrong about some of these, since a few advisories are light on detail.” concludes ZDI. “As always, I recommend testing and deploying these patches quickly, especially for network-facing services like DNS, DHCP, LDAP, and Exchange” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Patch Tuesday)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Details of the vulnerabilities are below - CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability CVE-2026-123158 OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability CVE-2026-123218 IBM Aspera Faspex Incorrect Authorization Vulnerability The first issue added to the catalog, CVE-2026-102895 (CVSS score of 9.8), is an improper authentication vulnerability affecting GPUStack, an open-source platform used to manage GPU clusters and AI model deployments. The flaw allows remote, unauthenticated attackers to bypass authentication and obtain administrator privileges by making requests appear to originate from the local system. Successful exploitation can expose sensitive information, create persistent administrator API keys, modify configurations and potentially execute arbitrary code. Exploitation has been observed in the wild against a GPUStack 2.1.1 deployment. Security researcher Javier Sixto reported the in-the-wild exploitation, but no specific threat group has been identified. The issue affects versions before 2.2.0. The second issue, CVE-2026-116779 (CVSS score of 9.8), is a code injection vulnerability in SignalWire FreeSWITCH, an open-source communications platform. The flaw allows attackers to send specially crafted SIP MESSAGE requests and abuse the API chat protocol to execute FreeSWITCH API commands. Depending on the configuration, this can expose credentials and configuration data, manipulate telephone calls and execute operating system commands with the privileges of the FreeSWITCH process. SignalWire confirmed that exploitation has been observed in the wild. The vulnerability was added to CISA’s KEV catalog on November 9, 2026, but no information identifying the attackers or a specific campaign has been disclosed. FreeSWITCH versions before 1.11.3 are affected. The third issue, CVE-2026-123158 (CVSS score of 8.1), is an authentication bypass vulnerability affecting OpenSSH. Under specific conditions, when OpenSSH runs on Linux systems using the musl C library without Pluggable Authentication Modules (PAM), the SSH server may incorrectly interpret password input as a password hash. A remote, unauthenticated attacker can exploit the flaw by submitting a specially crafted password to bypass authentication and access affected accounts. CISA added the vulnerability to its KEV catalog on November 6, 2026, indicating that exploitation has been observed. However, no specific threat actor or attack campaign has been publicly identified. OpenSSH versions before 10.6p2 are affected. The fourth issue, CVE-2026-123218 (CVSS score of 9.8), is an incorrect authorization vulnerability affecting IBM Aspera Faspex 5. It allows an authenticated user to craft a specific message that bypasses authorization checks and potentially gain full administrative privileges. Successful exploitation could give attackers access to sensitive information and allow them to modify or disrupt the affected system. IBM disclosed the vulnerability on November 7, 2026, and released a fix in Aspera Faspex 5.0.19 PL1. I found no public confirmation of exploitation in the wild or information identifying attackers at the time of writing. Versions 5.0.0 through 5.0.19 are affected. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the two vulnerabilities by November 12, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA) Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records. The intrusion was detected on November 6, and the company blocked the unauthorized access. However, an investigation into the incident revealed that the attacker likely had access to the system since mid-October. Nitori, often called the “IKEA of Japan,” is a major furniture and home furnishings retailer that operates 879 stores in Japan and another 219 stores across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong. The firm has an annual revenue of $5.8 billion. According to the company's notification, the incident impacts individual customers, corporate members, and non-members who placed orders through official Nitori stores and online shops.
ESET found Russia-Linked APT group Turla using a new toolset, dubbed Cereal, on government Exchange servers in Kazakhstan and Romania. ESET Research detailed a previously undocumented toolset it calls Cereal, built to run on Microsoft Exchange servers. The researchers found it on 28 November 2025 at a government body in Kazakhstan, and later at a government body in Romania, which was compromised on 23 December. The researchers discovered that in Romania, it was set up to spot emails to or from NATO and the European Union. ESET attributes it with high confidence to the Turla APT group (aka Secret Blizzard, Snake, Uroburos, Waterbug, Venomous Bear and KRYPTON) that has been active since at least 2004, targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Russia-nexus actor is assessed to be affiliated with Center 16 of Russia’s Federal Security Service (FSB). The name Cereal comes from serialization, a process that programs use to package data and code for transfer. Most of the toolset consists of modular .NET code that arrives encrypted, unpacks itself in memory and leaves almost no files on disk. Only the first loader is saved as a regular .NET file. One unusual feature is that ESET found no attacker-controlled server. The main backdoor, CerealNeuron, doesn’t connect to an external server. Instead, it runs on the victim’s Exchange server and waits for commands through web paths that look like normal Outlook Web Access, Autodiscover and ActiveSync traffic. This makes the activity difficult to spot in firewall logs. If a request isn’t properly encrypted or fails security checks, the server simply returns a normal-looking Exchange error page. “CerealNeuron, a passive backdoor with no built-in commands but capable of executing assemblies contained in CerealRunner binaries, received in network requests;” reads the analysis published by ESET. “The consequences are significant: Malicious traffic coexists with legitimate Exchange web services – exactly the kind of traffic defenders are least likely to block.” There is no dedicated C&C infrastructure to discover, block, or take down. The victim’s own internet-facing Exchange server is the operator-accessible control point. Network-based tracking is severely limited. We were unable to identify the ingress IP addresses used by the operators. They may have connected directly, via anonymization services, or from other compromised hosts.” As a result, defenders have no external server to block or take down. ESET couldn’t even identify the attackers’ IP addresses. A second version, called CerealHermit, has no network functions and reads encrypted command files directly from disk. This means some victims had two separate ways for attackers to access their systems. Commands work like disposable programs. Instead of one backdoor with a built-in menu, the operators send each task as a small compiled .NET program carried by a component called CerealRunner. The tasks include pulling mailboxes through Exchange Web Services, querying Active Directory, running WMI queries, extracting locally stored Windows credentials and handling files. ESET saw so many near-identical binaries that it believes the operators run an internal system that builds them automatically. The .NET tricks are what set this apart. The first loader abuses a rarely used feature to run native code before any .NET code, so an analyst sees an entry point that does nothing. Operators also dropped it into the Windows management folder under names like ncobjapi.dll, and into the .NET native image cache under names like Microsoft.Exchange.Search.Mdb.ni.dll, so trusted processes loaded it for them. The email theft is the part ESET calls new. The module, CerealBox, injects itself into EdgeTransport.exe, the process that handles mail flow, and wraps the handlers of transport agents already running in memory. “CerealBox uses a stealthier approach. Instead of registering itself, it is injected directly into EdgeTransport.exe, the Exchange process that handles email flow.” continues the report. “Reaching that point, however, is not straightforward: CerealBox is delivered through an intricate chain of nested Cereal components” It registers no new agent, so nothing shows up in Exchange’s configuration. A message qualifies if it carries a .doc, .docx or .pdf file and matches hardcoded lists of senders, recipients, subject words or file names. Selected messages get compressed, encrypted and staged on disk, and the operators collect and delete them later. The victims match Turla’s usual targets. According to ESET, around 70% of the countries targeted by the group since 2022 were former Soviet republics or European countries that once had close ties with Moscow. The focus on Romanian NATO and EU email systems is consistent with Russia’s long-standing intelligence interests. ESET also links the attacks in Kazakhstan to the country’s deportation of Russian exiles since January 2026. Activity in the country increased on January 15, the day after the Old New Year holiday. Organizations running Exchange should check for suspicious activity that may not be visible in standard configurations. This includes unusual DLL files in the Windows management folder, unexpected files in the native image cache and suspicious requests to the three web paths used by the backdoor. A clean list of Exchange transport agents does not necessarily mean that the mail system is free from compromise. “The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyberespionage.” concludes the report. “The Cereal toolset demonstrates that, for Turla, Exchange servers are not just mail servers – they are durable collection points, internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Microsoft released the Windows 10 KB5131096 extended security update, which includes this month's November 2026 Patch Tuesday fixes and a few bug fixes and changes. If you are running Windows 10 Enterprise LTSC or are enrolled in the ESU program, you can install this update as normal by going to Settings, clicking Windows Update, and manually running a 'Check for Updates.' After installing this update, Windows 10 will be updated to build 19045.7846, and Windows 10 Enterprise LTSC 2021 will be updated to build 19044.7846. Microsoft no longer releases new features for Windows 10, and the KB5131096 update mainly includes security updates and bug fixes. The update also includes fixes released as part of today's November 2026 Patch Tuesday, which addressed 1,235 vulnerabilities across Microsoft's products, including one actively exploited Outlook zero-day flaw.
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability. This Patch Tuesday addresses 66 "Critical" vulnerabilities, 48 of which are Remote Code Execution (RCE), 15 are Elevation of Privilege (EoP), and three are Use-After-Free in Microsoft Edge. The approximate number of bugs in each vulnerability category is listed below: Of the 1,235 vulnerabilities, approximately 639 are categorized under Windows or Microsoft Windows products/components. When BleepingComputer reports on Patch Tuesday security updates, we only count vulnerabilities released by Microsoft on Patch Tuesday itself. Therefore, today's total excludes 108 flaws fixed earlier this month, including one Entra Device Registration, 82 Mariner, and 25 Microsoft Edge flaws.
Microsoft has released the Patch Tuesday Windows 11 KB513261 and KB5131087 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs and add new features. Today's updates are mandatory as they contain the November 2026 Patch Tuesday security patches for hundreds of vulnerabilities discovered in previous months. You can install today's update by going to Start > Settings > Windows Update and clicking on 'Check for Updates.' You can also manually download and install the update from the Microsoft Update Catalog. This is the eleventh 'Patch Tuesday' release in 2026, and it's based on 24H2, which means 25H2 or 26H2 get the same update. There are no exclusive or special changes. You'll get the same fixes across the two versions of Windows 11. With today's update, Microsoft is adding new customization options to Windows 11 and fixing minor issues with File Explorer.
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. Xen Orchestra is a web-based management platform developed by French software company Vates, used to manage XCP-ng virtualization environments, including virtual machines, hosts, and pools. The vulnerability, tracked as VSA-2026-062, affects Xen Orchestra and the Xen Orchestra Appliance (XOA) and allows remote attackers with network access to the management interface to bypass authentication using a specially crafted cookie. A CVE identifier and CVSS score have not been assigned yet. According to a Vates security advisory, the flaw stems from how Xen Orchestra processes authentication tokens sent through REST API requests.
Confirm this action.
Leaving now will discard your changes.