Microsoft Patch Tuesday fixes Outlook flaw already under attack
Opening a crafted Outlook message can leak an NTLMv2 hash via CVE-2026-124194; a separate Windows Search RCE is not reported as exploited.
Stories per day · 30 days
3 RSS
Relatedmicrosoft7patch-tuesday6outlook4windows4exchange3ntlm2rce2remote-code-execution2azure1cve-2026-969511hyper-v1patch1preview-pane1windows-search1word1zdi1zero-day1
19 stories, newest first · one card per story
Stories tagged #office
Microsoft November 2026 patches critical RCEs and an exploited Outlook flaw
Only CVE-2026-124194, a moderate Outlook spoofing bug, is marked exploited; builds and fixes are not listed.
1
Exploited Outlook zero-day among 1,094 flaws patched by Microsoft
The moderate CVSS 6.5 flaw, CVE-2026-124194, leaks an NTLMv2 hash when a user opens a crafted message file.
ZDI lists November 2026 Microsoft fixes, one Outlook bug exploited
CVE-2026-124194 is the only listed flaw marked exploited; it is a Moderate CVSS 6.5 spoofing bug.
Microsoft Patches Two Dozen RCE Flaws in Office
Microsoft patched about two dozen high-severity Office remote-code-execution flaws, none known exploited.
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
Microsoft's October 2026 Patch Tuesday fixes 1,415 flaws, including 85 critical, with one Windows Shell bug exploited in the wild.
4
The October 2026 Security Update Review
ZDI's October 2026 review lists dozens of critical Microsoft Office, Azure, Exchange, and Windows flaws.
14
Microsoft's Nadella bows to Trump's language diktat on "Super Intelligence" and uses it to attack OpenAI and Anthropic
Satya Nadella calls AI models insider threats and criticizes OpenAI and Anthropic to defend Microsoft's business.
2
October 2026 Patch Tuesday forecast: Time for an Office cleanup
October 2026 Patch Tuesday forecast after September's record 973 Microsoft CVEs; Apple already patched exploited zero-day CVE-2026-86950.
8
Microsoft pauses KB5002907 update after Office license deactivations
Microsoft paused KB5002907 after it deactivated or removed perpetual Office 2016 and 2019 installs.
Microsoft fixes broken Excel copy and paste for all Office users
Microsoft fixed Excel copy-and-paste failures caused by September 2026 Office security updates.
Microsoft Confirms KB5002914 Update Breaks Copy and Paste on Excel
Microsoft confirms KB5002914 Excel security update silently breaks copy-paste in Excel 2016-2024, forcing admins to choose between usability and security fixes.
Microsoft confirms KB5002914 Excel update breaks copy and paste
Microsoft confirms KB5002914 Office security update silently breaks copy-paste, autofill, and formula dragging in Excel 2016 through 2024.
Microsoft Excel KB5002914 update breaks copy and paste for some users
Microsoft's September Patch Tuesday update KB5002914 breaks copy-and-paste and formula dragging in Excel 2016 through 2024; uninstalling the update restores functionality.
Microsoft Shatters Patch Tuesday Record With 974 CVE Fixes in September 2026
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited Windows zero-days, CVE-2026-85880 and CVE-2026-81963.
3
Microsoft September 2026 Patch Tuesday Fixes 973 Vulnerabilities and 2 Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including two zero-days already exploited in the wild.
Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)
Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.
Microsoft Patch Tuesday Update September 2026 – 974 Vulnerabilities Fixed, Including 2 Zero-Days
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities across Windows and Office, including two actively exploited Windows privilege-escalation zero-days.
5
ZDI-26-607: Microsoft Office HTML Injection Information Disclosure Vulnerability
ZDI disclosed an HTML injection flaw in Microsoft Office (CVSS 7.6) that lets remote attackers disclose sensitive information via malicious pages or files.