Microsoft's November Patch Tuesday: 1,259 Flaws Fixed, Including an Actively Exploited Outlook Bug That Can Leak NTLMv2 Hashes
Microsoft has shipped its November security update, and the headline number is hard to ignore: 1,259 vulnerabilities patched across the company's software portfolio. It marks the second month in a row that Redmond's monthly release has crossed the four-figure threshold, a trend that is reshaping how defenders plan their patch cycles.
The most urgent item in the bundle is an Outlook flaw that Microsoft says is already being exploited in the wild — and whose impact extends well beyond a single application. According to The Hacker News, the bug may allow attackers to expose NTLMv2 hashes, the credential material Windows uses to authenticate users across a network.
Why an NTLMv2 Leak Matters
NTLMv2 hashes are not passwords in plaintext, but they are valuable currency for attackers. A captured hash can be relayed to other systems, cracked offline with sufficient compute, or used to move laterally inside a network where NTLM authentication is still permitted. Attackers have spent years refining relay and coercion techniques precisely because credential material of this kind so often converts into broader access.
An email client is an especially attractive vector. Outlook sits on the endpoint of knowledge workers, executives, and administrators alike, and it routinely processes content from untrusted sources. A flaw that can be triggered through routine mail handling — and that leaks authentication material as a side effect — is the kind of issue that merits prioritization ahead of the rest of the month's backlog.
The Volume Problem
Breaking down the release, the bulk of the fixes land in Windows with 726 vulnerabilities, followed by 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in a second Developer Tools category, and 27 in SharePoint Server. The update also incorporates 165 CVE identifiers issued by organizations other than Microsoft, reflecting the growing practice of coordinating patches across shared components and third-party libraries.
Two consecutive months above 1,000 fixes is not simply a sign that Microsoft's code is getting worse. It reflects a maturing security program: broader fuzzing coverage, more aggressive internal discovery, expanded scope across cloud and developer tooling, and better accounting of vulnerabilities inherited from open-source dependencies. Still, the operational reality for IT teams is a monthly triage exercise of significant scale.
A Practical Prioritization Strategy
When the patch count runs into four figures, treating every CVE equally is a recipe for burnout. A defensible approach looks like this:
- Exploited-in-the-wild first. The Outlook NTLMv2 issue belongs at the top of the queue. Microsoft's exploitation status is the strongest available signal, and it should override severity scores when the two disagree.
- Internet-facing and authentication-adjacent next. Flaws in edge services, remote access components, and anything that touches credential handling deserve immediate attention.
- Then severity, then exposure. Critical-rated issues on systems that are reachable or hold sensitive data come before moderate issues on isolated workstations.
- Don't forget the non-Microsoft CVEs. The 165 externally issued identifiers often correspond to shared libraries and components that appear in more places than administrators expect.
Reducing the Blast Radius of Credential Theft
Patching is necessary but not sufficient. The Outlook issue is a reminder that NTLM remains a persistent liability in many Windows environments. Organizations should use the disclosure as an opportunity to audit where the protocol is still in use, restrict outbound authentication where possible, enable protections that block relay attacks, and move authentication toward stronger, phishing-resistant methods wherever feasible.
Segmenting networks so that a single compromised endpoint cannot relay credentials to high-value systems further limits the damage. So does monitoring for anomalous authentication patterns — unexpected NTLM traffic, authentication attempts from workstations to servers they have no business contacting, and spikes in failed authentications that suggest relay or brute-force activity.
What to Do This Week
- Inventory Outlook deployments and confirm the November update is applied, prioritizing accounts with elevated privileges.
- Review Microsoft's exploitation and severity ratings rather than relying on CVSS alone.
- Validate that detection coverage exists for suspicious NTLM authentication and relay-style behavior.
- Confirm backup and rollback plans before mass deployment, particularly for SQL Server and SharePoint, where update testing carries higher operational risk.
- Track the externally issued CVEs to ensure third-party components are covered by your software inventory.
The Bigger Picture
A monthly cadence of more than a thousand fixes is likely to be the new normal rather than an anomaly. That reality favors organizations that have automated patch management, risk-based prioritization, and telemetry that can catch exploitation attempts before patches land. The Outlook NTLMv2 flaw is a pointed example: the difference between a contained incident and a network-wide compromise may come down to how quickly a single mail client was updated — and how well the surrounding authentication infrastructure was hardened in advance.
For the full breakdown of this month's release, see the original reporting at The Hacker News.
