Microsoft Patch Tuesday discloses 1,093 bugs, including exploited Outlook flaw
Original title: Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row
CISA ordered agencies to patch exploited Outlook, Barracuda and other bugs, with Outlook due by month’s end.
Microsoft disclosed 1,093 vulnerabilities in its latest Patch Tuesday, including 63 rated critical. CVE-2026-124194 in Microsoft Outlook is exploited in the wild; CISA added it to the KEV catalog and set a federal deadline at the end of the month. CISA also ordered agencies to patch exploited Barracuda email-security bugs by Friday and investigate related compromises. Separately, N-able took hosted N-central offline after more than 30 serious flaws and public proof-of-concept scanning.
Unconfirmed: N-able reports scanning tied to public proof-of-concept code but no confirmed customer exploitation.
- CVE-2026-124194 has a severity score of 6.5 and affects Microsoft Outlook.
- Opening a crafted message can leak authentication data usable to impersonate the user.
- Tenable said Microsoft has disclosed more than 5,160 vulnerabilities this year.
- Agencies must patch Barracuda CVE-2026-116606 and CVE-2026-111560 by Friday.
- N-able said it has no evidence a customer environment was successfully exploited.
Impact: Outlook may leak authentication data usable to impersonate the user
| Product | Affected |
|---|---|
| Microsoft Outlook | — |
| Barracuda email security product | — |
| N-able N-central | — |
- 1.Federal agencies must patch CVE-2026-124194 by the end of the month.
- 2.Patch Barracuda CVE-2026-116606 and CVE-2026-111560 by Friday and investigate compromises.
- 3.N-able customers were ordered to turn off their N-central servers.
- AI models
- Claude
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | 1% | KEV | KEV |
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | 2% | KEV | KEV |
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEV | KEV |
From the original article
2 min read at therecord.mediaAn exploited Outlook vulnerability drew most of the attention in Microsoft's latest Patch Tuesday, which listed 1,093 bugs total.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.