Microsoft Patches Actively Exploited Outlook Zero-Day Amidst 1,094 Fixes

Microsoft has issued its November 2026 Patch Tuesday updates, addressing a critical zero-day vulnerability in Outlook that attackers are actively exploiting in the wild. The extensive security release tackles a total of 1,094 flaws across the company’s vast product ecosystem.

The actively exploited vulnerability, tracked as CVE-2026-124194, is a spoofing flaw in Microsoft Outlook. Rated as ‘moderate’ severity with a CVSS score of 6.5, the vulnerability allows an unauthenticated attacker to trick a user into opening a specially crafted malicious message file. When opened, Outlook can connect to an attacker-controlled network location without displaying the usual external content warning. This action could lead to the disclosure of the user’s NTLMv2 hash, which attackers could then use to impersonate the user and gain unauthorised access to systems.

Microsoft confirmed it was aware of active exploitation but did not provide specific details about the observed attacks. The company noted that the flaw cannot be triggered simply by viewing a message in the Outlook Preview Pane, requiring direct interaction from the victim. Products affected by this specific Outlook zero-day include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The vulnerability was privately reported to Microsoft by a researcher operating under the moniker ‘nono’ and Benoît Sevens, with Sevens acknowledging the use of Anthropic’s Claude AI model in the discovery.

Beyond the Outlook zero-day, Microsoft’s November 2026 Patch Tuesday addresses a wide array of vulnerabilities. Windows received the largest share of fixes with 726 patches, followed by Office with 174. Other significant updates include 59 vulnerabilities in SQL Server, 53 in developer tools, 27 in SharePoint Server, 20 in Azure, and nine in Exchange Server. The company also republished 165 CVEs from third parties, though Chrome vulnerabilities were not listed.

Critical-severity updates were released for numerous products, including Windows 10, Windows 11, Windows Server editions from 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, the Microsoft Malware Protection Engine, Azure OpenAI, and Azure Managed Grafana. This month’s release, while substantial, is smaller than October’s record-setting 1,413 vulnerabilities patched. With the latest round of updates, Microsoft has fixed over 5,000 vulnerabilities throughout 2026.

Users running Enterprise and Education editions of Windows 11 version 23H2 should note that these updates mark the final monthly security patches for those specific versions. Microsoft strongly urges all users and organisations to apply the latest security updates without delay to protect against confirmed and potential threats.