November Patch Tuesday fixes 1,235 Microsoft flaws, including an Outlook bug already under attack

Microsoft's monthly security update arrived Tuesday with fixes for 1,235 vulnerabilities across Windows, Office, Edge and its other products, according to BleepingComputer's count. That comes a month after a record 1,411 fixes in October, a surge BleepingComputer ties to Microsoft's growing use of AI to find bugs in its own software.

The one being exploited

Only one of this month's flaws is a zero-day, but it's the one to care about: a spoofing bug in Microsoft Outlook that attackers have already used to steal NTLM password hashes.

Here's how it works, based on Microsoft's description. An attacker sends a specially crafted message file and convinces the target to open it. Opening it makes Outlook connect to a network location the attacker controls, without showing the usual warning about external content. Windows may then try to sign in to that server automatically, handing over the user's NTLMv2 hash. An attacker can try to crack that hash offline, or use it to pose as the user and get into corporate accounts.

The attack needs the victim to open the file, which is why bugs like this usually show up in phishing campaigns. Outlook has had similar NTLM-leaking flaws before, and they were widely exploited.

By the numbers

• 1,235 flaws fixed on Patch Tuesday itself. That excludes 108 fixed earlier in the month, most of them in Microsoft's Mariner Linux distribution and in Edge.
• 66 rated Critical: 48 remote code execution bugs, 15 elevation-of-privilege bugs and 3 use-after-free bugs in Edge.
• About 639 in Windows and its components.

What to do

• Windows 11: install this month's cumulative update, KB5132061 or KB5131087 depending on your version, through Windows Update.
• Windows 10: if your PC is enrolled in Extended Security Updates, install KB5131096. Windows 10 PCs outside that program no longer receive security fixes.
• Outlook and Office: make sure Office is updated, and treat unexpected attachments with suspicion, especially message files from people you don't know.
• IT teams: this is a good moment to revisit standard defenses against NTLM leaks, such as blocking outbound SMB traffic (TCP port 445) at the network edge so hashes can't be sent to outside servers.