Microsoft and SAP Set New Records with Security Updates
In a significant development within the tech industry, Microsoft has announced a groundbreaking set of updates aimed at addressing over 1,200 vulnerabilities across its products. This unprecedented release further cements Microsoft’s commitment to security amidst growing threats in the digital landscape.
The updates were part of the November Patch Tuesday initiative and included a staggering total of 1,235 vulnerabilities that researchers and developers have now leveraged to improve product security. Among these patches was a critical zero-day vulnerability, which is particularly alarming as it is currently being exploited in active attacks in the wild.
Notably, this month’s record also marks the fourth time this year that Microsoft has issued an extraordinary number of patches. Previous records were established in July, September, and October, clearly indicating a troubling trend of increasing vulnerabilities that require urgent attention.
The highlighted zero-day vulnerability, identified as CVE-2026-124194, is a spoofing bug affecting Microsoft Outlook. This vulnerability has been exploited by attackers aiming to steal NTLM account hashes, which are essential credentials that can grant unauthorized access to user accounts.
Jack Bicer, director of vulnerability research at Action1, provided insights into how the attack operates. He described the mechanism whereby an attacker sends a meticulously crafted message file that, when opened by an unsuspecting user, instructs Outlook to connect to a network location under the attacker’s control. Alarmingly, this connection circumvents typical warnings about external content, thereby exposing the user’s NTLMv2 hash. This hashed version of their login credentials serves as a gateway for attackers to gain access as that specific user.
Even though the zero-day vulnerability is rated as "moderate," Bicer strongly recommends that system administrators prioritize it. He emphasized the urgency due to its exploitability; it merely requires one click on an email file to unleash potential havoc. Given that Outlook is an essential application utilized by nearly all organizations, the implications of a stolen hash are vast and detrimental. As such, Bicer urges IT departments to push the update to all Outlook users immediately, starting with those in administrative roles and high-value accounts.
In terms of the broader patch landscape, this month saw a plethora of Addressed Common Vulnerabilities and Exposures (CVEs). Specifically, 536 of these vulnerabilities relate to elevation of privilege (EoP), followed by 296 associated with remote code execution, and 157 tied to information disclosure. Among these, 66 vulnerabilities are considered critical, predominantly consisting of remote code execution flaws that present significant security risks.
SAP Joins the Ranks with Record Patch Volumes
Microsoft is not the only technology giant making headlines regarding security updates. SAP, another major player in the software industry, also reported an exceptional month for security patches during its November Patch Day. The updates delivered by SAP were substantial, addressing a historic total of 43 vulnerabilities, which included 12 Hot News Notes and 13 High-Priority updates.
The designation "Hot News" is the most critical ranking assigned to SAP security bulletins, indicating an urgent need for businesses to act. The sheer volume of patches released in November was notably twice the average size for the year 2026 and included four vulnerabilities that received a maximum CVSS score of 10.0—signifying the highest level of critical risk.
Major vulnerabilities addressed by SAP included CVE-2026-89103, a broken access control issue within the SAP Gateway, popularly known as “ProxyGate.” Other critical vulnerabilities tackled were CVE-2026-76964—associated with memory corruption in SAP NetWeaver AS ABAP, and CVE-2026-89126, which involved a similar corruption issue in SAP Web Dispatcher. Additionally, CVE-2026-120017 focused on a missing authentication vulnerability affecting SAML2 authentication in SAP NetWeaver.
The current trend of rising vulnerability disclosures from tech giants like Microsoft and SAP underscores an urgent call for all organizations to bolster their cybersecurity strategies. As these companies take proactive measures to mitigate risks, it becomes imperative for users to remain vigilant and ensure their systems are updated. The landscape is evolving rapidly, and defenders must stay one step ahead.