Microsoft releases fix for actively exploited Outlook zero-day

Microsoft released its November 2026 Patch Tuesday updates on Tuesday, fixing a set of vulnerabilities that includes one actively exploited Outlook spoofing zero-day. The zero-day, CVE-2026-124194, allows an unauthenticated attacker to craft a message file that, if the recipient opens it in a vulnerable Outlook build, triggers the exploit, Microsoft said. Opening the file may make Outlook reach out to a network location controlled by the attacker "without displaying the usual external-content warning," according to Microsoft's advisory. The connection may disclose the user's NTLMv2 hash, which the attacker could use to authenticate as the victim.

Microsoft labels the flaw moderate severity with a CVSS rating of 6.5 and states the Preview Pane cannot be used to launch the attack. Microsoft said the bug was not known publicly before the patch shipped, and its advisory names no attackers or victims. The flaw affects Microsoft 365 Apps for Enterprise, along with Office LTSC 2021 and Office LTSC 2024, Microsoft said. Microsoft credited researchers 'nono' and Benoît Sevens with discovering the flaw, and the acknowledgment for Sevens mentions Anthropic's Claude AI model.

The total number of fixes differs because of counting methods. BleepingComputer reported 1,235 vulnerabilities, including 66 critical issues made up of 48 remote code execution, 15 elevation of privilege, and three use-after-free in Edge, and said its total excludes 108 flaws fixed earlier in the month. SecurityWeek counted 1,094 vulnerabilities across Microsoft products and said Microsoft also republished 165 third-party CVEs. CyberSecurityNews counted 1,093 newly released fixes, including 63 critical, 1,029 important, and one moderate.

Critical updates are flagged in the release notes for Windows 10, Windows 11, Windows Server versions 2016 through 2025, the Office suite, Exchange Server Subscription Edition, the Edge browser, and Microsoft's malware protection engine, SecurityWeek said, along with Azure OpenAI and Azure Managed Grafana. CyberSecurityNews listed eight Hyper-V privilege escalation bugs and critical remote code execution issues in Message Queuing, SMB Server, TCP/IP, Exchange Server, LDAP, Schannel, CredSSP, IIS, and Print Spooler. SecurityWeek reported that Windows accounts for 726 flaws, Office 174, SQL Server 59, developer tools 53, SharePoint Server 27, Azure 20, and Exchange Server nine.

Defenders should prioritize the Outlook update because exploitation is already underway, CyberSecurityNews noted. SecurityWeek noted that this month's patch bundle is the last for Windows 11 23H2 Enterprise and Education, which will get no more monthly security fixes.