Microsoft fixes actively exploited Outlook vulnerability in November Patch Tuesday

Microsoft fixed an actively exploited Outlook spoofing flaw in its November 2026 Patch Tuesday release on Nov. 10, and the company confirmed attackers are already using it in the wild to steal authentication information.

The flaw, tracked as CVE-2026-124194, can expose a user’s NTLMv2 hash, which an attacker could use to impersonate the user, authenticate to other systems, or crack the user’s password. Microsoft rates the vulnerability as moderate severity with a CVSS score of 6.5, while Heise Online describes the severity as medium.

An attacker has to send a specially crafted message file and trick someone into opening it using a vulnerable Outlook build. Once the file opens, Outlook might reach out to an attacker-controlled network location and bypass the standard external-content warning. Microsoft says opening the message in Outlook’s preview pane does not set off the flaw.

Microsoft calls the issue a spoofing problem where Outlook fails to warn users about unsafe actions. An unauthorized attacker can carry out spoofing over a network. The vendor emphasized that successful exploitation requires network connectivity and user interaction.

A researcher known as nono and Benoît Sevens, who used Anthropic’s Claude AI model, received discovery credit from Microsoft. Microsoft has not said whether the researcher’s discovery preceded or followed the start of active exploitation, and the company has not blamed a specific threat actor for the observed attacks. The company has likewise not published technical details on how attackers are exploiting the flaw in the wild. Before shipping the fix, Microsoft had not made the flaw public.

The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog. The agency ordered federal agencies to install the patch by Nov. 24, 2026.

Malwarebytes says Office products affected by the flaw receive the patch separately from Windows, so administrators should check for Office updates in addition to Windows updates. Open an Office application. Click File or Office Account, both under Account. Then pick Product Information, select Update Options, click Update Now, and turn on updates first if needed.

If a work device lacks update options, reach out to the organization’s IT team, since that team may manage updates centrally. For Windows Update, open Settings, select Windows Update, click Check for updates, install any offered updates including Security Update KB5132061, then restart if prompted.

Jake Knott of watchTowr recommends beginning with internet-exposed systems, moving next to actively exploited flaws, and handling everything else last. Compromised credentials can give attackers access to systems and sensitive information, adding risk for organizations.

The sources do not agree on how many November 2026 Patch Tuesday vulnerabilities exist. SecurityWeek and CyberScoop reported 1,094 flaws, Redmondmag reported 1,093 with 63 rated critical, and The Hacker News reported 1,259.

Of the November flaws, Windows represented 726 and Office represented 174. SQL Server had 59 flaws, developer tools had 53, SharePoint Server had 27, Azure had 20, and Exchange Server had nine. Microsoft additionally republished 165 third-party CVEs.

CVE-2026-116928 in Windows Search can be exploited through Exchange Server when a malicious attachment is automatically indexed, and opening the email or attachment is not required for this attack.

Five other critical vulnerabilities carry CVSS scores of 9.8, and Microsoft says the five are not under active exploitation. They affect Windows LDAP, Windows Search, Azure OpenAI, Azure Managed Grafana, and Windows Xbox Live Networking Service. After the November patches, Microsoft has resolved more than 5,000 vulnerabilities this year, while Tenable’s Satnam Narang placed the year-to-date total above 5,100 CVEs. “Email is the easiest door into any company, and this flaw turns one opened file into a stolen identity,” said Jack Bicer, director of vulnerability research at Action1.

Microsoft’s November release was smaller than October’s record Patch Tuesday, when CrowdStrike counted 1,413 patched vulnerabilities. The October update on 13 October was a Patch Tuesday record, topping September’s nearly 1,000 flaws and the 1,261 flaws fixed during all of 2020. Only one October flaw was under active exploitation: CVE-2026-96951 sits in the Windows Shell, is rated Important, and carries a CVSS score of 8.8. The November updates are also the final monthly security updates for Windows 11 version 23H2 Enterprise and Education editions.

Heise Online advises administrators to confirm that Windows Update is turned on and that the latest security patches are installed. Attackers can exploit many flaws in Office, Windows and other products to run malicious code and compromise systems. In the November release, just one flaw is under active attack, and none had been publicly disclosed prior to release.