Microsoft patches exploited Outlook spoofing flaw in November updates
November 10: Krebs reports 1,093 fixes, 63 critical and 535 privilege-elevation flaws, and says only CVE-2026-124194 is already exploited. Microsoft has issued more than 5,100 patches this year.
Microsoft's November 2026 updates fix exploited Outlook spoofing flaw CVE-2026-124194; CISA requires remediation by November 24.
Microsoft's November 2026 updates address more than a thousand vulnerabilities, including CVE-2026-124194, an Outlook spoofing bug Microsoft says attackers have already used. Opening a crafted message file can make Outlook contact an attacker-controlled location without the usual external-content warning and leak an NTLMv2 hash. SecurityWeek rates it CVSS 6.5, says Preview Pane cannot trigger it, and lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 as affected. CISA added it to the Known Exploited Vulnerabilities catalog, requiring remediation by November 24; known ransomware use is unknown. SecurityWeek reports 1,094 flaws; Krebs on Security counts 1,093, of which 63 are critical.
- CISA due date is November 24, 2026, under vendor instructions and BOD 26-04.
- Impact is network spoofing that leaks an NTLMv2 hash, not code execution.
- Windows accounts for 726 fixes; last updates for Windows 11 23H2 Enterprise and Education.
- Krebs counts 535 privilege-elevation flaws and more than 5,100 Microsoft patches this year.
- SecurityWeek credits researchers nono and Benoît Sevens; Sevens' note cites Claude.
Timeline
dated events in the reporting · oldest first- Nov 10, 2026CISA added CVE-2026-124194 to the KEV catalog. · CISA
- Nov 10, 2026Microsoft released November updates fixing the Outlook flaw. · SecurityWeek
What each outlet adds
beyond the shared facts- CISANovember 24 deadline, BOD 26-04, ransomware use unknown.
- SecurityWeekNTLMv2 hash leak, Preview Pane limit, and last 23H2 updates.
- Krebs on Security1,093 flaws, 63 critical, 535 elevation, over 5,100 patches this year.
Coverage
oldest first · one row per article · UTC- · 1d ago
CISA Known Exploited VulnerabilitiesFirst report
CISA KEV lists Outlook spoofing flaw CVE-2026-124194
An unauthorized attacker can spoof over the network without the expected user interaction; deadline is November 24.
- · 6h ago
SecurityWeek
Exploited Outlook zero-day among 1,094 flaws patched by Microsoft
The moderate CVSS 6.5 flaw, CVE-2026-124194, leaks an NTLMv2 hash when a user opens a crafted message file.
- · 4h ago
Krebs on Security
Microsoft patches nearly 1,100 flaws, including exploited Outlook bug
CVE-2026-124194 is the only flaw Microsoft says is already exploited; 63 of this month's fixes are rated critical.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEVPoC | KEV |
| CVE-2026-125350 | Use-after-free in Chrome XML before 157.0.8103.50 | 8.8 | — | KEVPoC | KEV |