Microsoft November 2026 update fixes 1,093 flaws, one Outlook zero-day
Opening a crafted file can leak an NTLMv2 hash; the Preview Pane is not an attack vector.
74
Vulnerability1 · 1 read
CVE-2026-124228
Path traversal code execution in Microsoft Outlook
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A path traversal flaw in Microsoft Office Outlook lets an attacker who already has an authorized account run code over the network. No user interaction is required. Successful exploitation gives full control of confidentiality, integrity, and availability on the affected Outlook system. Microsoft has not listed affected builds or a fixed version.
What to do: Apply Microsoft's update for CVE-2026-124228. No workaround is named.
| Product | Affected |
|---|---|
| Microsoft Office Outlook | — |
Estimated exposure
largeunknown; authenticated Outlook users only — No install or scan figures given; network attack needs an authorized account, capping reach.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office Outlook allows an authorized attacker to execute code over a network.
- Weakness
- CWE-22
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H