An attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook
as part of a newly disclosed vulnerability.
Microsoft disclosed 1,093 bugs in its latest Patch Tuesday release. Last month, more than 1,400 vulnerabilities were disclosed by Microsoft after about 900 in September.
Among the disclosures is CVE-2026-124194, a Microsoft Outlook flaw carrying a severity score of 6.5 that the company confirmed is actively being exploited in the wild. The Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog.
Federal civilian agencies have until the end of the month to patch CVE-2026-124194. Benoît Sevens discovered the bug using Anthropic’s Claude.
Security updates for November 2026 are now available. Details are here: https://t.co/WW89TchdN8 #PatchTuesday #SecurityUpdateGuide pic.twitter.com/ADygXOUDZZ
Opening the malicious file causes Outlook to connect to an attacker-controlled network location without displaying standard external-content warnings. This behavior potentially discloses authentication information that allows an attacker to impersonate the user.
Satnam Narang, senior staff research engineer at Tenable, stated that an attack using the vulnerability may allow someone to sign in as the exploited user.
Massive Patch Tuesday update: Microsoft fixes 1,093 vulnerabilities in November 2026—highlighting an Outlook zero-day leaking NTLMv2 authentication hash, critical remote code execution bugs in Windows Network Auto-Setup, Function Discovery, Graphics Kernel, plus key fixes in Word…
Tuesday’s release brings Microsoft to more than 5,160 vulnerabilities disclosed this year.
Google, Cisco, Adobe, Barracuda, Ivanti and other software vendors released patches for dozens of bugs alongside Microsoft’s updates. CISA ordered federal agencies to investigate potential compromises and apply patches by Friday for CVE-2026-116606 and CVE-2026-111560, two vulnerabilities affecting Barracuda’s email security product.
‼️ Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities, Including Outlook Zero-Day Details: https://t.co/O58lkydF1i Microsoft has released its November 2026 Patch Tuesday updates, fixing 1,093 newly released vulnerabilities across Windows, Office, SQL Server,… pic.twitter.com/yfuo11eg8C
As expected, we are observing scanning activity associated with the published proof-of-concept code. At this time, we have no evidence that any customer environment has been successfully exploited,
the company stated on Tuesday.
During this time, customers will be unable to access their Hosted N-central classic environment, and associated services may be unavailable.
