November's Microsoft patches: do the domain controllers and Outlook first

Attackers are already using an Outlook bug that hands them a user's password hash, and the same Microsoft release fixes no-login holes in the servers that run your logins. Patch domain controllers and Exchange this week, and get Outlook updated everywhere before November 24.

A domain controllerdefinitionThe Windows server that runs Active Directory. It checks passwords, hands out Kerberos tickets and answers LDAP lookups, so whoever controls it controls the network. is the worst server to lose. Whoever runs code on it can create accounts, reset any password and push software to every joined machine. Two of this month's flaws reach it with no login at all, according to Microsoft. One is in LDAPdefinitionThe protocol applications use to look people and groups up in a directory. Domain controllers answer LDAP all day. and one is in KerberosdefinitionWhen you open a file share or an internal app, Windows usually proves who you are with a Kerberos ticket from the domain controller. A relay attack catches someone's sign-in and forwards it to a server that trusts it., and both carry a CVSS score of 9.8.

The good news is limited but real. Microsoft marks none of the 9.8 flaws as exploited or publicly disclosed, and rates most of them "exploitation less likely". Three of the identity and mail fixes carry Microsoft's "more likely" tag: an Active Directory code execution flaw, an Active Directory privilege escalation and an Exchange code execution flaw. Each of those needs a login of some kind first, which any phished employee account can supply.

The Outlook bug is the one attackers are using. Microsoft only scores it 6.5 and calls it Moderate, since someone has to open a file first. Don't let that lull you, as Nick Carroll of Nightwing put it to CSO Online. What leaks is the user's NTLMv2 hashdefinitionOlder Windows sign-ins send this scrambled version of your password instead of the password itself. Grab one and you can try cracking it offline, or relay it to another server and log in as that person., and Microsoft says an attacker can use it to sign in as that person. CISA lists ransomware use as unknown.

Engineers will spot the familiar shape. Outlook-triggered NTLM leaks have come up before, and the defence is the same each time: the hash only helps an attacker if it can leave your network and if somewhere still accepts NTLM. Among those Microsoft credits for the find is a researcher who used Anthropic's Claude. Satnam Narang of Tenable told CSO Online that after most of a year of AI adding noise to Patch Tuesday, this looks like the first time it has found a needle.

Start with the Kerberos flaw if you only read one advisory. Microsoft describes an unauthenticated attacker sending crafted Kerberos traffic and relaying the result to a domain controller, which ends with SYSTEM on that controller. Nobody has to click. Relay attacks against Windows authentication have a long history, and plenty of networks still carry old settings that make them easier.

The Windows Search flaw is the one Exchange teams tend to miss. The bug sits in a Windows component, so the fix comes in the Windows cumulative update for the server Exchange runs on. Installing the Exchange security update alone leaves it open. Exchange Server Subscription Edition gets its own update this month too, KB5133453, for the separate code execution flaw.

DNS, DHCP and iSCSI sound like plumbing, and Microsoft's notes say the attacker has to be on the network already. Don't park them for that reason. If your domain controllers also run DNS or DHCP, those machines are carrying several of this month's worst bugs at once. Dustin Childs of the Zero Day Initiative, as CSO Online reports, would ring-fence exposed services like DNS and DHCP.

Microsoft also lists a second package for Windows 11 24H2 and later, KB5132043, at build .9911. Windows 10 reached end of support on October 14, 2025, so those builds reach you only if the machines are enrolled in Extended Security Updates or run an LTSC edition. Server 2012 and 2012 R2 appear on the Kerberos advisory but not on the LDAP one, so don't assume one patch status covers both.

Pick the SQL Server package by branch. Find your current build, then match it to the CU or GDR line it's on. Microsoft's table shows a CU+GDR update for each cumulative-update branch and an RTM+GDR update for servers that only take security fixes.

Two smaller fixes touch identity directly. Someone already logged on to an Entra Private Network Connector server can pull credentials out through CVE-2026-109460, so get the connector to 1.5.5130.0. On Dynamics 365 on-premises, CVE-2026-122196 is an XML flaw scored 6.5, and it lets any logged-in user read files off the server.

Jack Bicer of Action1 put the order well in CSO Online: patch order should follow reach. He'd start with domain controllers and Exchange, then anything that exposes IIS, Schannel or RPC to untrusted networks. We agree, with one addition. Outlook has the only live exploit, so the desktop rollout has to run in parallel with the server work.

# If this errors, the KB isn't there yet. Swap in the KB for your version
PS> Get-HotFix -Id KB5131090
# Version and build summary for the machine
PS> Get-ComputerInfo -Property OsName, OsBuildNumber, OsHardwareAbstractionLayer
# SQL Server build, to match against the CU or GDR line
SQL> SELECT SERVERPROPERTY('ProductVersion');

Patching closes these particular holes. The pattern underneath them will come back, though. A leaked hash is only worth something where NTLM is still accepted, and a relay only works where servers don't insist on signed, bound connections. Those are settings you control.

Your IT team or provider runs the patching, and that's the right place for it. We pick up the identity work around it, which usually starts with finding where NTLM still runs. Our identity and access management people do that in Active Directory and Microsoft Entra, and Entra engineers can come in for a few weeks if the backlog is long. On Dynamics 365 on-premises, our Dynamics 365 team can plan the update. Not sure where the gaps are? Try the free assessment.