ZDI lists November 2026 Microsoft fixes, one Outlook bug exploited
CVE-2026-124194 is the only listed flaw marked exploited; it is a Moderate CVSS 6.5 spoofing bug.
74
CVE-2026-118730
Use-after-free in Microsoft Excel allows remote code execution
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A use-after-free flaw in Microsoft Office Excel lets an unauthorized attacker execute code over the network. No privileges are required, but the user must interact with the attacker’s content. Successful exploitation gives the attacker full control of the affected process (confidentiality, integrity, and availability). Microsoft has not listed affected builds.
What to do: Apply Microsoft’s update for CVE-2026-118730. No workaround is named.
| Product | Affected |
|---|---|
| Microsoft Office Excel | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H