[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYw96rDne9bdRcQ5pDFlJOVeN2FvxL6c3J34KNLjP5Mc":3},{"article":4,"iocs":50,"watch_terms":55,"solutions":56,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"54fcd653-4f95-4976-8d94-006237fb3875","Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft","exploited-outlook-zero-day-among-1-094-flaws-patched-by-microsoft-3ead3c","CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation. The post Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft appeared first on SecurityWeek.","Microsoft's November 2026 Patch Tuesday addresses 1,094 vulnerabilities, including a zero-day in Outlook (CVE-2026-124194) that is being actively exploited. This moderate-severity spoofing flaw allows an unauthenticated attacker to trick a user into opening a malicious file, potentially disclosing NTLMv2 hashes. The vulnerability affects Microsoft 365 Apps for Enterprise and Office LTSC versions and was discovered by researchers 'nono' and Benoît Sevens.","Microsoft patched an exploited Outlook zero-day and 1,093 other vulnerabilities.","https:\u002F\u002Fwww.securityweek.com\u002Fexploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F03\u002FMicrosoft-Outlook-CVE-2023-23397.jpg","2026-11-10T19:19:46+00:00","2026-11-10T20:00:06.940358+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"Microsoft Outlook","product",{"name":21,"type":19},"Microsoft 365 Apps for Enterprise",{"name":23,"type":19},"Office LTSC 2021",{"name":25,"type":19},"Office LTSC 2024",{"name":27,"type":28},"Microsoft","vendor",{"name":30,"type":31},"AI","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":52,"value":53,"context":54},"cve","CVE-2026-124194","Exploited Outlook zero-day vulnerability",[27,18,21],{"controls":57,"vendors":141},[58,86,112],{"slug":59,"name":60,"problem":61,"products":62},"patch-management","Automated patch management","Known holes get closed in days, not months.",[63,71,78],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":72,"vendor_name":27,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":87,"name":88,"problem":89,"products":90},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[91,99,104],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":72,"vendor_name":27,"vendor_logo":73,"product_slug":100,"product_name":101,"url":102,"description":103},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":113,"name":114,"problem":115,"products":116},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[142],{"slug":72,"name":27,"logo_path":73,"roles":143},[144],"affected",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":155},"actively-exploited-outlook-zero-day-highlights-urgency-of-prompt-patching","Actively Exploited Outlook Zero-Day Highlights Urgency of Prompt Patching","An actively exploited zero-day vulnerability in Microsoft Outlook (CVE-2026-124194) allows unauthenticated attackers to steal NTLMv2 credential hashes simply by tricking a user into opening a malicious file. Because the flaw was being exploited before a patch was available, organizations relying on routine monthly patching cycles were left exposed during the window between discovery and remediation. NTLMv2 hash theft is particularly dangerous as it enables pass-the-hash and relay attacks that can facilitate lateral movement across a network. The scale of November's Patch Tuesday — 1,094 vulnerabilities — underscores that vulnerability backlogs remain a persistent and systemic risk. Prioritizing zero-days and actively exploited flaws for emergency patching is essential to reducing attacker dwell time.",[150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-02: Incident Mitigation","NIS2 Article 21(2)(e)","MITRE ATT&CK T1187: Forced Authentication",{"NIS2 Article 21(2)(e)":156,"NIST SP 800-53 SI-2: Flaw Remediation":157,"MITRE ATT&CK T1187: Forced Authentication":158,"NIST CSF 2.0 RS.MI-02: Incident Mitigation":159,"CIS Control 7: Continuous Vulnerability Management (v8)":160},"This point requires security in acquisition, development and maintenance including vulnerability handling and disclosure, obligating organisations to have processes that act rapidly on actively exploited vulnerabilities like this Outlook zero-day.","SI-2 mandates identifying, reporting, and correcting system flaws within organisation-defined timeframes, directly covering the need for rapid deployment of this Outlook patch.","CVE-2026-124194 exploits the forced authentication technique by coercing the victim's client into leaking NTLMv2 hashes when a malicious file is opened.","This category calls for mitigating the effects of detected incidents, which includes applying compensating controls (such as blocking outbound NTLM) while a patch is deployed for an actively exploited flaw.","CIS Control 7 requires prioritising remediation of actively exploited vulnerabilities, which would have driven emergency patching of CVE-2026-124194 before attackers could leverage it."]