Microsoft shipped fixes for 1,259 vulnerabilities on Tuesday, and the one already being used in the wild is rated Moderate. CVE-2026-124194, a spoofing flaw in Outlook with a CVSS score of 6.5, is flagged by Microsoft as actively exploited. CISA added it to its Known Exploited Vulnerabilities catalog, giving federal agencies until November 24, 2026 to apply the fix.
The mechanism is a familiar one. Outlook's UI fails to warn users before an unsafe action. An unauthenticated attacker sends a specially crafted message file and persuades the target to open it in an affected version of Outlook. Opening it could cause Outlook to connect to an attacker-controlled network location without showing the usual external-content warning, potentially disclosing authentication information such as an NTLMv2 hash that an attacker could use to impersonate the user. Microsoft says exploitation requires both network connectivity and user interaction.
Jack Bicer, director of vulnerability research at Action1, argues the Moderate label undersells it. "Email is the easiest door into any company, and this flaw turns one opened file into a stolen identity," he said. "A captured hash can let an attacker sign in as the victim, read their data, and move to other systems they can reach." His point about the rating is fair. The flaw is being exploited, it needs only a single click on an email file, and it hits a product nearly every organization runs.
Microsoft has not attributed the activity to any threat actor, has not published technical details on how it is being exploited, and has not said whether the discovery came before or after attackers started using it. The flaw was credited to a researcher named Nono and to Anthropic's Benoît Sevens, who used Claude to find and report it.
Patch it, and throttle the leak where you can't
The patch is the fix, and for anything internet-facing or exposed to inbound mail it should go in ahead of the KEV deadline rather than on it. Where patching lags on some hosts, the damage path here is an outbound connection to an attacker's network location that can disclose authentication information such as an NTLMv2 hash. Egress controls that block outbound SMB and NTLM authentication to hosts outside your network limit what that leaked hash can reach, and they are worth having regardless of this specific CVE. They do not replace the patch; they reduce the blast radius if a user opens the file before the patch lands.
The rest of the load
This is the second consecutive month Microsoft's patch volume has topped 1,000. The 1,259 fixes break down to 726 in Windows, 174 in Office, 59 in SQL Server, 61 in Developer Tools, and 27 in SharePoint Server, plus 165 CVE identifiers not issued by Microsoft itself. Elevation of privilege accounts for more than 500 of them, with remote code execution and information disclosure behind it. By Tenable's count, courtesy of senior staff research engineer Satnam Narang, Microsoft has now addressed over 5,100 CVEs this year.
Several of the non-Outlook bugs are worth a look depending on what you run. Remote code execution flaws landed in Windows Search (CVE-2026-116928), LDAP (CVE-2026-119958), Windows Schannel (CVE-2026-119952), the Windows Virtual Filtering Platform (CVE-2026-95962), and the Xbox Live Networking Service (CVE-2026-112967). There is also a privilege escalation flaw in Azure OpenAI (CVE-2026-119990).
With a thousand-plus fixes two months running, triage beats completeness. Jake Knott, head of threat intelligence at watchTowr, put the order plainly: "Start with what you actually have exposed to the Internet, then what's already being exploited in the wild, and only then everything else. Before going into panic mode, check whether you even use the vulnerable component, or meet the prerequisites for exploitation." For CVE-2026-124194 the prerequisites are low, which is why it belongs near the top of the list.
Top comments (0)