Microsoft Says Outlook Zero-Day Was Exploited as It Patches 1,094 Flaws

Summary

Microsoft patched 1,094 vulnerabilities in its November 2026 updates and says an Outlook spoofing flaw, CVE-2026-124194, was exploited. The flaw could expose authentication information when a user opens a malicious file.

Key points

Microsoft says CVE-2026-124194, a moderate-severity Outlook spoofing flaw, was exploited; its advisory gives no details about the observed attacks.
The flaw can cause Outlook to connect to an attacker-controlled network location and disclose a user’s NTLMv2 hash after the user opens a specially crafted message file.
Microsoft says the flaw cannot be triggered through the Preview Pane; affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.
The November updates address 1,094 vulnerabilities across Microsoft products; Windows accounts for 726 and Office for 174.
Microsoft says this is the final monthly security update for Windows 11 version 23H2 Enterprise and Education editions.

Article Details

Event Type: Microsoft November 2026 Patch Tuesday security update addressing 1,094 vulnerabilities, including an exploited Outlook zero-day.
Impact: Microsoft says CVE-2026-124194 could cause Outlook to connect to an attacker-controlled network location without the usual warning, disclosing a user's NTLMv2 hash. Exploitation requires the victim to open a malicious file; the flaw cannot be triggered through the Preview Pane. Microsoft rated it moderate (CVSS 6.5) and said its advisory provides no details about the observed attacks. The updates also mark the end of monthly security updates for Enterprise and Education editions of Windows 11 version 23H2.