Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft

Microsoft's November 2026 Patch Tuesday addresses 1,094 vulnerabilities, among them an actively exploited Outlook zero-day tracked as CVE-2026-124194. The spoofing bug lets an attacker send a specially crafted message file that, once opened, makes Outlook silently connect to an attacker-controlled server without the usual warning, exposing the victim's NTLMv2 hash and allowing impersonation. Microsoft rates it only 'moderate' severity with a CVSS of 6.5, says it cannot be triggered via the Preview Pane, and has shared no details on the attacks observed; Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 are affected. The rest of the update batch spans 726 Windows fixes, 174 in Office, 59 in SQL Server, plus numerous flaws in SharePoint Server, Azure, Exchange Server, and developer tools, alongside 165 republished third-party CVEs, bringing Microsoft's 2026 total past 5,000 patched vulnerabilities.