Microsoft patches nearly 1,100 flaws, including exploited Outlook bug
Original title: Microsoft Fixes Nearly 1,100 Security Vulnerabilities
CVE-2026-124194 is the only flaw Microsoft says is already exploited; 63 of this month's fixes are rated critical.
Microsoft's November Patch Tuesday fixes 1,093 vulnerabilities in Windows and supported software, including 63 critical flaws, nearly half of them remote code execution. Microsoft says only CVE-2026-124194, an Outlook spoofing bug affecting Microsoft 365 Apps for Enterprise and Microsoft Office, is already being exploited. Apple, Google, Mozilla, and Adobe also shipped fixes this week; Adobe said it has no evidence its issues are exploited. Microsoft has issued more than 5,100 security patches so far this year.
Unconfirmed: The article calls CVE-2026-125350 a Chrome zero-day but does not say it is being exploited.
- 535 of this month's Microsoft flaws allow privilege elevation.
- Microsoft shipped more than 1,400 fixes last month.
- Chrome 157.0.8103.50 fixes nine holes, including zero-day CVE-2026-125350.
- Firefox 160 resolves almost 100 CVEs, about half high severity.
- CISA's KEV list has added 217 exploited vulnerabilities so far this year.
Impact: Outlook spoofing under active attack; many flaws allow elevation or code execution.
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Outlook | — | — |
| Microsoft 365 Apps for Enterprise | — | — |
| Microsoft Office | — | — |
| Google Chrome | — | 157.0.8103.50 |
| Mozilla Firefox | — | 160 |
| Apple operating systems | — | 27.2.1 |
- 1.Apply Microsoft's November updates, including the fix for Outlook CVE-2026-124194.
- 2.Update Chrome to 157.0.8103.50 and Firefox to version 160.
- 3.Move Apple devices to OS version 27.2.1, including hardware still on iOS 18.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEV | KEV |
| CVE-2026-125350 | Use-after-free in Chrome XML before 157.0.8103.50 | 8.8 | — | KEVPoC | KEV |
From the original article
3 min read at krebsonsecurity.com
Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month's Patch Tuesday addresses 63 critical flaws -- including a zero-day in Microsoft Outlook -- and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla.
By BrianKrebs · krebsonsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.