Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
Microsoft patched an exploited Outlook zero-day and 1,093 other vulnerabilities.
Microsoft's November 2026 Patch Tuesday addresses 1,094 vulnerabilities, including a zero-day in Outlook (CVE-2026-124194) that is being actively exploited. This moderate-severity spoofing flaw allows an unauthenticated attacker to trick a user into opening a malicious file, potentially disclosing NTLMv2 hashes. The vulnerability affects Microsoft 365 Apps for Enterprise and Office LTSC versions and was discovered by researchers 'nono' and Benoît Sevens.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn actively exploited zero-day vulnerability in Microsoft Outlook (CVE-2026-124194) allows unauthenticated attackers to steal NTLMv2 credential hashes simply by tricking a user into opening a malicious file. Because the flaw was being exploited before a patch was available, organizations relying on routine monthly patching cycles were left exposed during the window between discovery and remediation. NTLMv2 hash theft is particularly dangerous as it enables pass-the-hash and relay attacks that can facilitate lateral movement across a network. The scale of November's Patch Tuesday — 1,094 vulnerabilities — underscores that vulnerability backlogs remain a persistent and systemic risk. Prioritizing zero-days and actively exploited flaws for emergency patching is essential to reducing attacker dwell time.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-124194