ZDI lists November 2026 Microsoft fixes, one Outlook bug exploited
CVE-2026-124194 is the only listed flaw marked exploited; it is a Moderate CVSS 6.5 spoofing bug.
74
CVE-2026-119990
Missing authentication in Azure OpenAI enables privilege elevation
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Azure OpenAI is missing authentication on a critical function. An unauthenticated attacker on the network can call it without user interaction and elevate privileges, with high impact to confidentiality, integrity, and availability. Microsoft has not listed affected builds or a fixed version. Customers of Azure OpenAI are affected.
What to do: Apply Microsoft's update for CVE-2026-119990. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Microsoft Azure OpenAI | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.
- Weakness
- CWE-306
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
2 storiesMicrosoft November 2026 update fixes 1,093 flaws, one Outlook zero-day
Opening a crafted file can leak an NTLMv2 hash; the Preview Pane is not an attack vector.
74