{"slug": "microsofts-patch-tuesday-surpasses-1000-bugs-for-second-month-in-a-row", "title": "Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row", "summary": "Microsoft disclosed 1,093 vulnerabilities in its latest Patch Tuesday release, the second consecutive month above 1,000, and said one — CVE-2026-124194, a severity 6.5 flaw in Microsoft Outlook — is being exploited in the wild, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities catalog with an end-of-month patch deadline for federal agencies. Microsoft credited Benoît Sevens with discovering the bug using Anthropic's Claude, and Tenable senior staff research engineer Satnam Narang noted the release brings Microsoft to more than 5,160 vulnerabilities disclosed in 2026, which would far surpass any previous year. CISA separately gave agencies until Friday to patch CVE-2026-116606 and CVE-2026-111560 in Barracuda's email security product, while N-able took all hosted N-central environments offline after a researcher uncovered more than 30 serious vulnerabilities in the remote management tool.", "body_md": "# Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row\n\nMore than 1,000 vulnerabilities were disclosed by Microsoft in the latest Patch Tuesday release as federal cybersecurity officials ordered civilian agencies to patch exploited bugs from Google, Barracuda and Cisco.\n\n Among the [1,093 bugs](https://x.com/msftsecresponse/status/2120220395018318285) disclosed on Tuesday, Microsoft said one is being exploited in the wild: [CVE-2026-124194](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194). The company said it has a severity score of 6.5 and impacts Microsoft Outlook.  \n\nThe Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog and gave federal agencies until the end of the month to patch it.\n\nMicrosoft said the bug was discovered by Benoît Sevens using Anthropic’s Claude, writing that an attacker “could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.”\n\n“Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user,” the company said.\n\nSatnam Narang, senior staff research engineer at Tenable, said an attack using the vulnerability may allow someone to sign in as the exploited user.\n\nSeveral experts said CVE-2026-124194 was the only exploited bug outlined in Microsoft’s Patch Tuesday release but there were 63 vulnerabilities rated critical. Narang noted that Tuesday’s release brings Microsoft to more than 5,160 vulnerabilities disclosed this year, which would far surpass any previous year.\n\n Last month, more than [1,400 vulnerabilities](https://therecord.media/new-ivanti-microsoft-bugs-exploitation) were disclosed by Microsoft after [about 900](https://therecord.media/microsoft-patch-tuesday-september-2026) in September.  \n\n In addition to Microsoft’s disclosures, [Google](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html), [Cisco](https://sec.cloudapps.cisco.com/security/center/publicationListing.x), [Adobe](https://www.adobe.com/trust/security/bulletins-and-advisories.html), [Barracuda](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection), [Ivanti](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US) and several other companies released patches for dozens of bugs, several of which were spotlighted by CISA as being exploited.  \n\nCISA gave federal agencies until Friday to patch CVE-2026-116606 and CVE-2026-111560 — two bugs affecting Barracuda's email security product. They also ordered all federal agencies to investigate potential compromises related to both vulnerabilities.\n\n## Response to N-able vulnerabilities\n\n A researcher also [uncovered](https://www.linkedin.com/posts/seanbales_today-i-bring-you-able2shell-a-repository-ugcPost-7525411483350970368-x331/) more than 30 serious vulnerabilities in N-Central, a popular remote management tool that IT teams use to monitor and run networks remotely.  \n\n The company behind it, N-able, took all hosted N-central environments offline and [ordered](https://uptime.n-able.com/event/202580/) customers to turn off their servers.  \n\n“As expected, we are observing scanning activity associated with the published proof-of-concept code. At this time, we have no evidence that any customer environment has been successfully exploited,” the company said on Tuesday.\n\n“During this time, customers will be unable to access their Hosted N-central classic environment, and associated services may be unavailable.”\n\nJonathan Greig\n\nis a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.", "url": "https://wpnews.pro/news/microsofts-patch-tuesday-surpasses-1000-bugs-for-second-month-in-a-row", "canonical_source": "https://therecord.media/patch-tuesday-microsoft-1000-bugs-again", "published_at": "2026-11-10 20:55:00+00:00", "updated_at": "2026-11-10 21:19:57.692409+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["Microsoft", "CISA", "Anthropic", "Claude", "Benoît Sevens", "Tenable", "Satnam Narang", "N-able"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/microsofts-patch-tuesday-surpasses-1000-bugs-for-second-month-in-a-row", "markdown": "https://wpnews.pro/news/microsofts-patch-tuesday-surpasses-1000-bugs-for-second-month-in-a-row.md", "text": "https://wpnews.pro/news/microsofts-patch-tuesday-surpasses-1000-bugs-for-second-month-in-a-row.txt", "jsonld": "https://wpnews.pro/news/microsofts-patch-tuesday-surpasses-1000-bugs-for-second-month-in-a-row.jsonld"}}