Microsoft patches nearly 1,100 flaws, including exploited Outlook bug
CVE-2026-124194 is the only flaw Microsoft says is already exploited; 63 of this month's fixes are rated critical.
76
Product
Microsoft 365 Apps for Enterprise
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenNov 10, 2026
- Last mentioned3h ago
Timeline
3 articles · newest firstExploited Outlook zero-day among 1,094 flaws patched by Microsoft
The moderate CVSS 6.5 flaw, CVE-2026-124194, leaks an NTLMv2 hash when a user opens a crafted message file.
76
Microsoft November 2026 update fixes 1,093 flaws, one Outlook zero-day
Opening a crafted file can leak an NTLMv2 hash; the Preview Pane is not an attack vector.
74
Related CVEs
by mentions- Missing unsafe-action warning in Microsoft Office Outlook
- Use-after-free in Chrome XML before 157.0.8103.50
- Unauthenticated privilege elevation in Azure Managed Grafana
- Unauthenticated remote code execution in Windows LDAP
- Authenticated remote code execution in Exchange Server
- Null pointer dereference RCE in Microsoft Defender
- Use-after-free in Microsoft Office Outlook
- Heap buffer overflow in Microsoft Outlook via network
- Race condition RCE in Windows SMB srvnet.sys
- Uninitialized resource use in Outlook allows remote code execution
Appears with
- Microsoftvendor · 3
- Outlookproduct · 3
- Windowsproduct · 3
- Office LTSC 2024product · 2
- Office LTSC 2021product · 2
- Microsoft Defenderproduct · 1
- Chromeproduct · 1
- Azure Managed Grafanaproduct · 1
- Firefoxproduct · 1
- Ivantiorganization · 1
- Googlevendor · 1
- Mozillavendor · 1
- CISAorganization · 1
- Microsoft Officeproduct · 1
- Adobevendor · 1
- Exchange Serverproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.