November 2026 Patch Tuesday: Outlook Zero-Day Guide for Texas SMBs

According to Microsoft's advisory and public analysis from security researchers, CVE-2026-124194 is a spoofing flaw in classic Outlook. When a user opens a specially crafted file, Outlook silently connects to an attacker-controlled location and leaks the user's NTLMv2 hash. Microsoft describes the root cause as the interface not warning users about an unsafe action.

• Severity: rated CVSS 6.5, which understates the real-world risk because it is already being used in attacks.
• Trigger: the user has to open the file. Researchers report the Preview Pane is not an attack path.
• Scope: all supported versions of classic Outlook for Windows.
• CISA KEV: security reporting indicates CISA added it to the Known Exploited Vulnerabilities catalog on November 10, with a November 24 deadline for federal agencies. Treat that date as your deadline too.

A stolen NTLM hash can be cracked offline or relayed to other systems that still accept NTLM authentication. That is why a "medium" score should not push this to the bottom of your list, and why it pairs badly with weak passwords and flat networks.

The Outlook bug gets the attention, but the critical remote code execution fixes are where an unpatched Houston office can get hurt fastest. Several carry a CVSS score of 9.8 and need no user interaction:

• Windows Schannel (CVE-2026-119952): pre-authentication remote code execution through crafted packets, rated by Microsoft as more likely to be exploited.
• Windows Search (CVE-2026-116928): pre-authentication code execution triggered by a malicious attachment, relevant anywhere mail is indexed.
• Core infrastructure services: critical fixes for Windows DNS, LDAP, DHCP Server, iSCSI, and Kerberos. These run on domain controllers and file servers, the systems that hold the keys to everything else.
• Business applications: critical fixes for SharePoint Server, SQL Server, and Azure DevOps Server, plus a top-severity flaw in Entra device registration.

Most Texas SMBs run at least one of these roles on-premises, even if email has moved to Microsoft 365. If you still run on-premises Exchange, note that only Exchange Subscription Edition is supported; older versions receive no fixes at all.

With a release this large, sequencing matters more than speed on any single system. A sensible order for a small or mid-sized business:

1. Outlook and Office on every workstation within 48 hours, because it is exploited today and every user is a target.
2. Domain controllers and DNS/DHCP servers next, with a tested backup and a maintenance window. Patch one DC, confirm replication and logons, then the rest.
3. Internet-facing and line-of-business servers: SharePoint, SQL Server, and anything published to the internet.
4. Everything else on your normal cycle, using exploitability data to decide what jumps the queue. Our guide to EPSS vulnerability prioritization explains how.

If you do not have a documented cadence, start with our patch management strategy for Texas SMBs. For context on how quickly release sizes have grown, see our breakdown of July's record Patch Tuesday.

Patching closes this bug, but NTLM hash theft keeps coming back in new forms. A few hardening steps make the next one far less useful to an attacker:

• Block outbound SMB (TCP 445) at the firewall so workstations cannot authenticate to servers on the internet.
• Add privileged users to the Protected Users group, which stops NTLM authentication for those accounts.
• Require SMB and LDAP signing to blunt relay attacks against internal servers.
• Audit NTLM usage and plan to retire it where Kerberos or modern authentication works.
• Separate admin accounts so a cracked user hash never reaches a domain admin. Our Active Directory tiering model shows how.

Many of these controls are already licensed if you are on Microsoft 365 Business Premium. Our overview of Business Premium security features covers what to turn on.

Because this Outlook flaw was exploited before the fix, check for warning signs rather than assuming you are clean:

• Outbound SMB or WebDAV connections from workstations to unfamiliar external IP addresses.
• Unusual NTLM logons, especially from accounts that normally use Kerberos or from unexpected hosts.
• Failed or successful sign-ins from new locations shortly after a user opened an unexpected attachment.

If anything looks wrong, reset the affected passwords, revoke sessions, and follow a structured process like our zero-day vulnerability response plan.

Today, confirm that the November cumulative updates have been approved and deployed to every Outlook installation, then schedule domain controller patching for this week. Pull a compliance report from Intune, WSUS, or your RMM tool and chase every device that has not checked in. If your IT provider cannot tell you exactly which machines are still unpatched, that is the real finding; our article on managed IT SLA tiers and response times explains what to expect. Our cybersecurity services team can run a rapid patch and NTLM exposure review, and our managed IT services keep updates on a predictable schedule. For peer benchmarks, see the Texas SMB IT and cybersecurity benchmark.

• Houston managed IT
• Sugar Land managed IT
• The Woodlands managed IT