Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft

Microsoft’s November 2026 Patch Tuesday updates fix 1,094 vulnerabilities across its products, including an Outlook bug that the company says has been exploited. The zero-day, tracked as CVE-2026-124194 , has been classified as a spoofing flaw and stems from Outlook not alerting users before a potentially dangerous action takes place. Microsoft has assigned it a severity rating of ‘moderate’ and a CVSS score of 6.5. The company’s advisory provides no information the observed attacks. For an attack to work, the victim needs to be tricked into opening a malicious file, according to Microsoft. “An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user,” the tech giant said. The flaw cannot be triggered through the Preview Pane, Microsoft said. It also clarified, “This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.” The vulnerability was not publicly disclosed before the fix became available. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Microsoft’s advisory credits a researcher using the moniker ‘nono’ and Benoît Sevens with the discovery. The acknowledgment for Sevens mentions the use of Anthropic’s Claude AI model. Windows accounts for 726 of the flaws patched this month , followed by Office with 174. Microsoft also resolved 59 vulnerabilities in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, and nine in Exchange Server. In addition, the company republished 165 CVEs from third parties, noting that Chrome vulnerabilities are not listed. Microsoft’s release summary lists critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the list. The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities . With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year. This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates. Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

The zero-day, tracked as CVE-2026-124194 , has been classified as a spoofing flaw and stems from Outlook not alerting users before a potentially dangerous action takes place. Microsoft has assigned it a severity rating of ‘moderate’ and a CVSS score of 6.5. The company’s advisory provides no information the observed attacks. For an attack to work, the victim needs to be tricked into opening a malicious file, according to Microsoft. “An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user,” the tech giant said. The flaw cannot be triggered through the Preview Pane, Microsoft said. It also clarified, “This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.” The vulnerability was not publicly disclosed before the fix became available. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Microsoft’s advisory credits a researcher using the moniker ‘nono’ and Benoît Sevens with the discovery. The acknowledgment for Sevens mentions the use of Anthropic’s Claude AI model. Windows accounts for 726 of the flaws patched this month , followed by Office with 174. Microsoft also resolved 59 vulnerabilities in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, and nine in Exchange Server. In addition, the company republished 165 CVEs from third parties, noting that Chrome vulnerabilities are not listed. Microsoft’s release summary lists critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the list. The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities . With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year. This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates. Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Microsoft has assigned it a severity rating of ‘moderate’ and a CVSS score of 6.5. The company’s advisory provides no information the observed attacks. For an attack to work, the victim needs to be tricked into opening a malicious file, according to Microsoft. “An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user,” the tech giant said. The flaw cannot be triggered through the Preview Pane, Microsoft said. It also clarified, “This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.” The vulnerability was not publicly disclosed before the fix became available. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Microsoft’s advisory credits a researcher using the moniker ‘nono’ and Benoît Sevens with the discovery. The acknowledgment for Sevens mentions the use of Anthropic’s Claude AI model. Windows accounts for 726 of the flaws patched this month , followed by Office with 174. Microsoft also resolved 59 vulnerabilities in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, and nine in Exchange Server. In addition, the company republished 165 CVEs from third parties, noting that Chrome vulnerabilities are not listed. Microsoft’s release summary lists critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the list. The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities . With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year. This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates. Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

For an attack to work, the victim needs to be tricked into opening a malicious file, according to Microsoft. “An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user,” the tech giant said. The flaw cannot be triggered through the Preview Pane, Microsoft said. It also clarified, “This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.” The vulnerability was not publicly disclosed before the fix became available. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Microsoft’s advisory credits a researcher using the moniker ‘nono’ and Benoît Sevens with the discovery. The acknowledgment for Sevens mentions the use of Anthropic’s Claude AI model. Windows accounts for 726 of the flaws patched this month , followed by Office with 174. Microsoft also resolved 59 vulnerabilities in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, and nine in Exchange Server. In addition, the company republished 165 CVEs from third parties, noting that Chrome vulnerabilities are not listed. Microsoft’s release summary lists critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the list. The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities . With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year. This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates. Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

“An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user,” the tech giant said. The flaw cannot be triggered through the Preview Pane, Microsoft said. It also clarified, “This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.” The vulnerability was not publicly disclosed before the fix became available. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Microsoft’s advisory credits a researcher using the moniker ‘nono’ and Benoît Sevens with the discovery. The acknowledgment for Sevens mentions the use of Anthropic’s Claude AI model. Windows accounts for 726 of the flaws patched this month , followed by Office with 174. Microsoft also resolved 59 vulnerabilities in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, and nine in Exchange Server. In addition, the company republished 165 CVEs from third parties, noting that Chrome vulnerabilities are not listed. Microsoft’s release summary lists critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the list. The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities . With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year. This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates. Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

The flaw cannot be triggered through the Preview Pane, Microsoft said. It also clarified, “This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.” The vulnerability was not publicly disclosed before the fix became available. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Microsoft’s advisory credits a researcher using the moniker ‘nono’ and Benoît Sevens with the discovery. The acknowledgment for Sevens mentions the use of Anthropic’s Claude AI model. Windows accounts for 726 of the flaws patched this month , followed by Office with 174. Microsoft also resolved 59 vulnerabilities in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, and nine in Exchange Server. In addition, the company republished 165 CVEs from third parties, noting that Chrome vulnerabilities are not listed. Microsoft’s release summary lists critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the list. The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities . With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year. This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates. Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

The vulnerability was not publicly disclosed before the fix became available. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Microsoft’s advisory credits a researcher using the moniker ‘nono’ and Benoît Sevens with the discovery. The acknowledgment for Sevens mentions the use of Anthropic’s Claude AI model. Windows accounts for 726 of the flaws patched this month , followed by Office with 174. Microsoft also resolved 59 vulnerabilities in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, and nine in Exchange Server. In addition, the company republished 165 CVEs from third parties, noting that Chrome vulnerabilities are not listed. Microsoft’s release summary lists critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the list. The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities . With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year. This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates. Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Microsoft’s advisory credits a researcher using the moniker ‘nono’ and Benoît Sevens with the discovery. The acknowledgment for Sevens mentions the use of Anthropic’s Claude AI model. Windows accounts for 726 of the flaws patched this month , followed by Office with 174. Microsoft also resolved 59 vulnerabilities in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, and nine in Exchange Server. In addition, the company republished 165 CVEs from third parties, noting that Chrome vulnerabilities are not listed. Microsoft’s release summary lists critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the list. The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities . With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year. This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates. Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Windows accounts for 726 of the flaws patched this month , followed by Office with 174. Microsoft also resolved 59 vulnerabilities in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, and nine in Exchange Server. In addition, the company republished 165 CVEs from third parties, noting that Chrome vulnerabilities are not listed. Microsoft’s release summary lists critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the list. The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities . With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year. This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates. Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

In addition, the company republished 165 CVEs from third parties, noting that Chrome vulnerabilities are not listed. Microsoft’s release summary lists critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the list. The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities . With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year. This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates. Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Microsoft’s release summary lists critical-severity updates for Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine. Azure OpenAI and Azure Managed Grafana are also on the list. The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities . With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year. This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates. Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

The November release is smaller than October’s, when Microsoft patched a record 1,413 vulnerabilities . With the latest round of patches, Microsoft has fixed more than 5,000 vulnerabilities this year. This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates. Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

This month’s updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2. Devices running these editions will not receive any further monthly security updates. Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Adobe’s latest Patch Tuesday updates fix roughly 110 vulnerabilities across nine products. Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Related : Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Related : Microsoft Patches Two Dozen RCE Flaws in Office Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Related : Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

More from Eduard Kovacs

Chrome Update Patches Exploited XML Zero-Day, Eighth This Year

Revolve Puts Data Breach Victim Count at 1.5 Million

Over 3 Million People Hit by Frontline Education Data Breach

Google DeepMind’s AI Agents Make 1024-Bit RSA Keys Cheaper to Attack

SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins

OpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the Line

Grocery Giant Ahold Delhaize Estimates Financial Toll of October Cyberattack

OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions

Adobe Patches 110 Vulnerabilities Across 9 Products

Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes

Google Widens Gemini 4 Carbon Access After AI Agents Verify Signal Code

Today: CISO Forum Virtual Summit 2026 – Join Global Cybersecurity Leaders

WhiteMatter Raises $20 Million in Series A Funding

SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities

Over a Dozen Organizations Hit in Qubole Supply Chain Attack

Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes

Flipboard Whatsapp Whatsapp Email