Microsoft November patches fix 1,094 bugs, one exploited
CVE-2026-124194 can leak an Outlook user’s NTLMv2 hash; two zero-click remote code execution bugs also ship.
78
CVE-2026-124194
Missing unsafe-action warning in Microsoft Office Outlook
CISA: Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
- CVSS 3.1
- 6.5 medium
- EPSS
- —
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
Microsoft Office Outlook's interface does not warn the user before a potentially unsafe action. An unauthenticated attacker can trigger spoofing over the network if the user interacts with the content, and can obtain confidential information. Microsoft Office is affected. CISA lists this as known exploited.
What to do: Apply Microsoft's mitigations for CVE-2026-124194, including the November 2026 security update. If mitigations are unavailable, discontinue use of the product, per CISA.
| Product | Affected |
|---|---|
| Microsoft Office | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
KEVCISA Known Exploited Vulnerability
- Affected
- Microsoft Office
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- microsoft
- Products
- 365 apps, office 2021, office 2024
- Weakness
- CWE-356
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
In the news
12 storiesMicrosoft November patches include exploited Outlook flaw CVE-2026-124194
The release covers 1,093 flaws, 63 rated critical, plus Exchange, SharePoint, Windows Search, and LDAP bugs.
78
Microsoft Patch Tuesday discloses 1,093 bugs, including exploited Outlook flaw
CISA ordered agencies to patch exploited Outlook, Barracuda and other bugs, with Outlook due by month’s end.
78
Microsoft November 2026 Patch Tuesday fixes 1093 CVEs, one exploited
Outlook spoofing CVE-2026-124194, used as a zero-day, leaks NTLMv2 hashes when a crafted Office file is opened.
78
CISA adds six exploited vulnerabilities to its KEV catalog
Entries cover Cisco BroadWorks, Barracuda products, Outlook, and Chromium; FCEB agencies must prioritize them under BOD 26-04.
78
Microsoft patches nearly 1,100 flaws, including exploited Outlook bug
CVE-2026-124194 is the only flaw Microsoft says is already exploited; 63 of this month's fixes are rated critical.
76
Exploited Outlook zero-day among 1,094 flaws patched by Microsoft
The moderate CVSS 6.5 flaw, CVE-2026-124194, leaks an NTLMv2 hash when a user opens a crafted message file.
76
Microsoft November patches cover 1,260 flaws, one Outlook bug exploited
SANS says 68 issues are critical and CVE-2026-124194, an Outlook spoofing bug, is already exploited.
76
Microsoft November patches list 1,094 CVEs; one Outlook flaw exploited
CISA added the exploited Outlook spoofing bug to KEV; a Windows Search flaw is called zero-click code execution.
74
ZDI lists November 2026 Microsoft fixes, one Outlook bug exploited
CVE-2026-124194 is the only listed flaw marked exploited; it is a Moderate CVSS 6.5 spoofing bug.
74
Microsoft November 2026 update fixes 1,093 flaws, one Outlook zero-day
Opening a crafted file can leak an NTLMv2 hash; the Preview Pane is not an attack vector.
74
CISA KEV lists Outlook spoofing flaw CVE-2026-124194
An unauthorized attacker can spoof over the network without the expected user interaction; deadline is November 24.
74