Microsoft Patches Exploited Outlook Zero-Day Among 1,094 Vulnerabilities
Microsoft's November Patch Tuesday addresses 1,094 vulnerabilities, including a zero-day in Outlook (CVE-2026-124194) that has been actively exploited in the wild.
Microsoft has released its November 2026 Patch Tuesday updates, which include fixes for a staggering 1,094 vulnerabilities across its product suite. Among these is a zero-day flaw affecting Microsoft Outlook, identified as CVE-2026-124194, which the company has confirmed is being actively exploited by attackers.
The vulnerability, classified as a moderate-severity spoofing flaw with a CVSS score of 6.5, allows an unauthenticated attacker to trick a user into opening a specially crafted malicious message file. Upon opening, Outlook could connect to an attacker-controlled network location without the usual external-content warning, potentially leading to the disclosure of authentication information, such as NTLMv2 hashes. This information could then be used by the attacker to impersonate the user.
Microsoft's advisory explicitly states that the flaw cannot be triggered through the Outlook Preview Pane. The vulnerability affects several versions of Microsoft Office, including Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The company has not provided specific details about the observed attacks, but the potential for credential theft and impersonation highlights the severity of the issue.
The discovery of CVE-2026-124194 is credited to a researcher known by the moniker 'nono' and Benoît Sevens, with the latter's acknowledgment noting the use of Anthropic's Claude AI model in the research process. The vulnerability was not publicly disclosed prior to the availability of the patches, a common practice for zero-days to limit attacker opportunities.
Beyond the critical Outlook zero-day, the November update addresses a vast number of other vulnerabilities. Windows systems account for the majority, with 726 flaws patched. Office products received fixes for 174 vulnerabilities, while SQL Server (59), developer tools (53), SharePoint Server (27), Azure (20), and Exchange Server (9) also saw significant updates.
Microsoft also reissued 165 CVEs from third-party vendors, noting that vulnerabilities in Google Chrome are not included in this specific release. Critical severity updates were issued for various Windows versions (10, 11, Server 2016-2025), Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine, alongside updates for Azure OpenAI and Azure Managed Grafana.
This month's patch release is comparatively smaller than October's record-breaking update, which addressed 1,413 vulnerabilities. However, with over 5,000 vulnerabilities fixed this year, Microsoft continues to address a substantial security backlog. Notably, the November updates mark the final ones for the Enterprise and Education editions of Windows 11 version 23H2, meaning these devices will no longer receive monthly security updates.
The release also coincides with Adobe's November Patch Tuesday, which addresses approximately 110 vulnerabilities across nine of its products, underscoring a busy month for software security updates across major vendors.
This latest report from SANS Internet Storm Center details a significantly larger volume of vulnerabilities patched by Microsoft in November 2027, totaling 1,260 compared to the 1,094 mentioned previously. While the critical CVE-2026-124194 in Outlook remains a key focus due to active exploitation, this update highlights an expanded scope including 68 critical flaws and 167 Chromium-related issues affecting Microsoft Edge. Additionally, new critical vulnerabilities in Microsoft Queuing and Queue Manager (CVE-2026-109459, CVE-2026-119967, CVE-2026-116710, CVE-2026-119963, CVE-2026-119964) and a critical RCE in LDAP (CVE-2026-119958) are now detailed.
This update from Cyber Security News provides a more granular breakdown of the vulnerabilities patched, detailing the specific counts for Elevation of Privilege, Remote Code Execution, and Information Disclosure flaws. It also highlights additional critical vulnerabilities in Excel, Word, PowerPoint, and Hyper-V that were not explicitly mentioned in the initial report.
This update from Tenable provides further detail on Microsoft's November 2026 Patch Tuesday, specifically highlighting the breakdown of 1093 CVEs across 287 products. It emphasizes the critical RCE vulnerabilities in Active Directory Domain Services (CVE-2026-118146), Exchange Server (CVE-2026-118207), and Windows Schannel (CVE-2026-119952), alongside the moderate Outlook spoofing vulnerability (CVE-2026-124194) that was exploited as a zero-day. The report also notes that Elevation of Privilege vulnerabilities constitute nearly half of the patched issues.