Microsoft November Patch Tuesday Addresses Over 1,000 Vulnerabilities Including Actively Exploited Outlook Zero-Day

Analysis
Moderate confidence rests on four outlets that agree on the November exploited-flaw count and details, but only a short recent run of monthly releases is available for comparison. Two primary sources, the Centre for Cybersecurity Belgium and Cisco Talos, agree on the exploited flaw despite small differences in totals, and the secondary outlets add no conflicting claims. The Outlook bug shows that a Moderate-rated flaw can expose NTLMv2 credentials, so triage keyed to severity ratings will miss it. Defenders should patch Outlook first, then the CVSS 9.8 Windows Search flaw reachable through Exchange, which needs no user interaction. Microsoft has not named the attackers, so detection should rely on monitoring for outbound NTLM authentication to external hosts. Microsoft's December 2026 Patch Tuesday, due December 8 to 9, will likely include a fix for at least one vulnerability that Microsoft says is being exploited in the wild. A quieter month may reflect a lull rather than a trend, and attackers using AI to reverse patches could exploit flaws only after release, leaving December without a Microsoft-confirmed zero-day. If one appears, teams must run an emergency patch cycle within days. If not, they can stage deployment normally and spend the time on the Exchange and domain controller fixes.