Microsoft Patch Tuesday fixes Outlook flaw already under attack
Opening a crafted Outlook message can leak an NTLMv2 hash via CVE-2026-124194; a separate Windows Search RCE is not reported as exploited.
Microsoft’s November Patch Tuesday fixes more than 1,000 vulnerabilities, including 48 critical remote code execution flaws. Attackers are already exploiting Outlook bug CVE-2026-124194, rated 6.5, which skips the usual external-content warning and can expose an NTLMv2 hash. A second highlighted flaw, CVE-2026-116928, is a 9.8 out-of-bounds write in Windows Search that Microsoft says could run code when Exchange indexes a malicious attachment without the user opening it. Microsoft has not reported exploitation of that Search flaw.
Unconfirmed: Affected and fixed version ranges are not stated; only CVE-2026-124194 is described as exploited.
- The exploited Outlook issue is patched through Office updates, so Windows-only patching may miss it.
- An attacker must persuade the user to open a specially crafted message file.
- The Search flaw’s described path is automatic indexing of an email attachment on Exchange Server.
- Readers are told to look for Security Update KB5132061 in Windows Update history.
Impact: Exposes an NTLMv2 hash usable to impersonate the user
| Product | Affected |
|---|---|
| Microsoft Outlook | — |
| Microsoft Windows Search Component | — |
- 1.Update Office from File > Account > Update Options > Update Now.
- 2.Install Windows security updates and check whether KB5132061 is already present.
- 3.Treat the Office update as a priority because the Outlook flaw is exploited.
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-116928 | Out-of-bounds write RCE in Windows Search Component | 9.8 | — | ||
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEVPoC | KEV |
From the original article
3 min read at malwarebytes.com
Microsoft’s November 2026 Patch Tuesday fixes an actively exploited Outlook vulnerability. Check for Office updates separately.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.