Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-a9c61ebfa0Early warningVulnerabilityConfirmed

Microsoft patches record 1,235 flaws, including exploited Outlook zero-day

BleepingComputer reports that Microsoft's November 2026 Patch Tuesday fixes 1,235 flaws, a record count. The item says one of them is an actively exploited Outlook zero-day.

Written by a model from the sources below. Verify against them.

Sources15Confirmed
Kind
Vulnerability
Vendor
Microsoft
Product
Outlook
Status
Confirmed
First seen
Confirmed

What to do

  • Install the November 2026 Microsoft security updates on all Outlook and Windows systems

  • Prioritize the Outlook zero-day fix and check Microsoft's advisory for interim mitigations

  • Review Outlook logs for unusual activity until patched

  • Apply Microsoft's security update for Outlook as soon as possible

  • Block or restrict inbound messages from untrusted senders until patched

  • Review Microsoft's advisory for CVE-2026-124194 for mitigation guidance

Timeline

  1. Made public by Mastodon
  2. First seen by cve.now
  3. Confirmed as CVE-2026-124194

Evidence 15

  1. Social
    Mastodon
    “Microsoft says attackers are exploiting a flaw in Outlook”
  2. Press
    BleepingComputer
    “Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability.”
  3. Social
    Bluesky
    “Microsoft November 2026 Patch Tuesday fixes a record 1,235 vulnerabilities, including one actively exploited Outlook zero-day.”
    +11 more: Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky
  4. Social
    Mastodon
    “Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.”
    +4 more: Mastodon, Mastodon, Mastodon, Mastodon
  5. Press
    SecurityWeek
    “CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation.”
Show all 15 sourcesShow fewer sources
  1. Social
    Mastodon
    “Outlook zero-day in the wild: one crafted message file leaks NTLM hashes with no warning.”
    +1 more: Mastodon
  2. Social
    Bluesky
    “Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft”
  3. Social
    Bluesky
    “Exploited Outlook zero-day CVE-2026-124194 (CVSS 6.5) leaks NTLMv2 hashes via a crafted message file.”
  4. Social
    Mastodon
    “⚠️ FAILLE CRITIQUE CVE-2026-124194 activement exploitée : Microsoft Office Outlook – Action potentiellement dangereuse sans interaction de l'utilisateur”
  5. Social
    Mastodon
    “Microsoft's latest update, KB5131096, is here to give your Windows 10 device a vital security boost, packing fixes for 1,235 vulnerabilities, including an actively exploited Outlook zero-day.”
  6. Press
    The Record
    “An exploited Outlook vulnerability drew most of the attention in Microsoft's latest Patch Tuesday, which listed 1,093 bugs total.”
  7. Social
    Mastodon
    “Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.”
  8. Social
    Mastodon
    “Microsoft's Nov 10 fixes include exploited Outlook CVE-2026-124194.”
    +2 more: Mastodon, Mastodon
  9. Social
    Bluesky
    “Microsoft patches Outlook zero-day CVE-2026-124194, a spoofing flaw exploited in the wild and added to CISA KEV.”
  10. Social
    Bluesky
    “including an actively exploited Outlook zero-day that can expose NTLM authentication hashes when a user opens a specially crafted message file.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-a9c61ebfa0

Has Microsoft confirmed it?

Mastodon, BleepingComputer and Bluesky report a possible compromise. None of the sources says it happened.Source: Mastodon, BleepingComputer, Bluesky, Mastodon, SecurityWeek, Mastodon, Bluesky, Bluesky, Mastodon, Mastodon, The Record, Mastodon, Mastodon, Bluesky, Bluesky

What should Microsoft users do?

Install the November 2026 Microsoft security updates on all Outlook and Windows systems. Prioritize the Outlook zero-day fix and check Microsoft's advisory for interim mitigations. Review Outlook logs for unusual activity until patched. Apply Microsoft's security update for Outlook as soon as possible. Block or restrict inbound messages from untrusted senders until patched. Review Microsoft's advisory for CVE-2026-124194 for mitigation guidance.

Does it have a CVE?

Yes. It is tracked as CVE-2026-124194.Source: CVE-2026-124194

Sources

Tracked as