Microsoft Outlook Zero-Day Exploited Amid Cloud Outage

• •CVE-2026-124194 is a zero-day vulnerability in Microsoft Outlook with confirmed exploitation.
• •Microsoft's cloud outage began on November 12, 2026, but no link to the zero-day has been established.
• •Patches for the Outlook vulnerability must be applied by November 24, 2026, according to CISA.

On November 10, 2026, CISA added the CVE-2026-124194 zero-day vulnerability in Microsoft Outlook to its KEV catalog, confirming active exploitation. This vulnerability allows unauthenticated attackers to trick users into opening malicious message files, potentially exposing their NTLMv2 hashes. Just two days later, on November 12, Microsoft experienced a significant global cloud outage affecting services like Outlook and Teams. While the timing of the vulnerability disclosure and the outage raised concerns, no direct link between the two incidents has been established. Microsoft has released patches for the vulnerability and is urging users to apply them by November 24, 2026. Other vulnerabilities, including CVE-2026-125350 in Google Chrome and several flaws in Cisco and Barracuda products, were also reported as actively exploited during this period.