Microsoft Patches 1,235 Security Flaws: Outlook Zero-Day Already Under Attack

Microsoft has more than 1,000 security vulnerabilities to clean up this month, but one Outlook flaw is already attracting the wrong kind of attention.

The company released its November 2026 Patch Tuesday updates on Nov. 10, addressing 1,235 vulnerabilities, according to BleepingComputer’s analysis. That figure includes Chromium-based flaws in Microsoft Edge. Tenable’s analysis counted 1,093 Microsoft CVEs.

Among the fixes is an actively exploited Outlook zero-day that could expose Windows authentication information when someone opens a malicious file. For businesses, patching vulnerable Outlook installations should be an immediate priority.

Microsoft patches Outlook zero-day already under attack

The most urgent vulnerability is CVE-2026-124194, an Outlook spoofing flaw that Microsoft has confirmed is being actively exploited.

According to SecurityWeek, Microsoft assigned the flaw a Moderate severity rating and a CVSS score of 6.5. Despite that relatively modest score, attackers are already exploiting it.

The attack involves a specially crafted message file. When opened in an affected version of Outlook, the file could cause the application to connect to an attacker-controlled network location without displaying the usual external-content warning. That connection could expose an NTLMv2 authentication hash, which attackers might attempt to crack offline or abuse in certain authentication attacks.

Capturing an authentication hash does not automatically compromise an account. The risk depends on factors including password strength, authentication protections, and network configuration.

Importantly, simply receiving a malicious email does not trigger the vulnerability. Exploitation requires someone to open the malicious file and have the necessary network connectivity.

Microsoft has confirmed active exploitation but has not publicly identified the attackers or disclosed the scope of the attacks.

Which Outlook versions are affected?

Affected installations may include Microsoft 365 Apps and supported perpetual Office editions. Organizations should consult Microsoft’s vulnerability advisory to identify affected products and applicable updates.

One important distinction: installing the latest Windows cumulative update does not necessarily fix the Outlook vulnerability.

The flaw requires the appropriate Office or Microsoft 365 Apps security update. IT administrators should verify Office update compliance separately from Windows update status.

For businesses, the potential consequences include credential theft, unauthorized network access, and additional incident response work.

The vulnerability also highlights the importance of stronger authentication protections. TechRepublic previously examined Windows 11 security features, including passkeys and Microsoft Defender.

November Patch Tuesday addresses more than 1,000 vulnerabilities

The Outlook zero-day is only one part of Microsoft’s unusually large November security release.

BleepingComputer counted 1,235 vulnerabilities, including 66 Critical flaws. Its tally includes 142 Chromium-based Microsoft Edge vulnerabilities.

Tenable separately counted 1,093 Microsoft CVEs, including 63 Critical vulnerabilities. The 142-vulnerability difference reflects which Edge flaws are included in each analysis.

BleepingComputer’s breakdown includes:

• 536 elevation-of-privilege vulnerabilities: Could allow attackers to gain additional permissions.
• 296 remote code execution vulnerabilities: Could potentially allow malicious code to run on affected systems.
• 157 information disclosure vulnerabilities: Could expose sensitive information.
• 46 denial-of-service vulnerabilities: Could disrupt applications or services.
• 27 security feature bypass vulnerabilities: Could allow attackers to circumvent protections.
• 22 spoofing vulnerabilities: Could help attackers impersonate trusted identities.

The sheer number of fixes creates a challenge for enterprise IT teams, but severity and exploitation requirements matter more than the overall count.

Critical vulnerabilities affect enterprise services

Several Critical vulnerabilities involve remote code execution across Windows, Office, and enterprise services.

One example is CVE-2026-118207, a Microsoft Exchange Server remote code execution vulnerability. According to Tenable, an authenticated attacker could potentially exploit the flaw to execute code over a network.

Organizations should check Microsoft’s November Exchange Server security update guidance and confirm which security update applies to their installed Exchange version.

However, a Critical rating does not necessarily mean a vulnerability is being actively exploited. Administrators should consider exposure, affected configurations, and the requirements for exploitation when prioritizing updates.

The large release continues a trend seen in recent months. In July, TechRepublic reported on Microsoft’s record-breaking Patch Tuesday, which addressed 570 vulnerabilities.

Microsoft’s November update also strengthens NTLM security

Alongside the vulnerability fixes, Microsoft is strengthening NTLM authentication, the older Windows technology involved in the Outlook zero-day’s potential credential exposure.

According to Microsoft’s NTLM guidance, the November updates introduce protections related to CVE-2026-118737, a Windows Remote Procedure Call Runtime remote code execution vulnerability stemming from improper cryptographic signature verification.

Beginning with the November 2026 updates, Windows clients offer NTLM signing by default for authenticated connections. The change helps ensure sessions establish a cryptographic session key and negotiate genuine message signing rather than relying on a legacy placeholder that offers no cryptographic protection.

However, servers can still accept unsigned connections during the initial rollout. Microsoft plans to require signing by default on Windows servers beginning in May 2027.

Anonymous and guest sessions are exempt from the signing requirements.

For administrators, the changes mean:

• Windows clients offer NTLM signing by default, strengthening authentication when servers support it.
• Servers temporarily accept signed and unsigned connections, allowing time to address legacy compatibility issues.
• Enhanced auditing helps identify unsigned connections before stricter enforcement begins.

Microsoft documents NTLM Enhanced auditing events 4022 and 4023 for Windows Server 2019 and later.

Both signed and unsigned connections can generate Warning-level events, so administrators must examine the negotiated signing flags rather than relying on event severity alone.

Businesses should use the transition period to identify legacy applications that may be affected. These NTLM improvements are separate from the Outlook zero-day fix and do not replace the need to install the applicable Office security update.

What Windows users and IT administrators should do now

With so many vulnerabilities addressed this month, the priority should be reducing exposure to the flaws posing the greatest immediate risk.

For Windows and Outlook users

• Update Office and Outlook. In supported desktop Office applications, open File, select Account, then Update Options and Update Now if available. Company-managed devices may receive updates through IT.
• Avoid unexpected attachments. Be cautious with message files, even when they appear to come from familiar contacts.
• Use multifactor authentication. MFA reduces some account compromise risks, although it does not eliminate every threat involving stolen NTLM authentication material.
• Check Windows Update separately. On Windows 11, open Settings and select Windows Update. Remember that Windows updates alone may not address the Outlook flaw.

For IT administrators

1. Prioritize CVE-2026-124194. Identify vulnerable Outlook installations and deploy the applicable Office security updates. Microsoft’s November security release notes and Security Update Guide provide vulnerability and update information.
2. Verify Office patch compliance. Confirm installed Office builds contain the fix rather than relying solely on Windows update reports.
3. Review NTLM signing readiness. Use Microsoft’s auditing guidance to identify unsigned connections and address compatibility issues before May 2027.
4. Investigate suspicious authentication activity. Review endpoint and network telemetry for unusual connections to external systems.
5. Prioritize exposed systems. Address applicable Critical vulnerabilities affecting internet-facing Exchange, SharePoint, and Windows Server installations.
6. Test and deploy Windows updates. Validate compatibility with essential applications before expanding deployment.

TechRepublic previously covered Microsoft’s recommendation to accelerate Windows updates, highlighting the importance of reducing delays between vulnerability disclosure and remediation.

Which Windows versions are affected?

Microsoft’s November release includes updates for supported Windows 11 versions and eligible Windows 10 systems enrolled in Extended Security Updates.

The Windows 11 updates include:

• KB5132061: Windows 11 versions 26H2 and 25H2, plus supported 24H2 Enterprise and Education editions.
• KB5132059: Windows 11 version 26H1.
• KB5131087: Windows 11 version 23H2 Enterprise and Education, which reached end of support on Nov. 10, 2026.

Windows 11 23H2 Enterprise and Education received their final scheduled security update this month. Meanwhile, Windows 11 24H2 Home and Pro reached the end of regular servicing on Oct. 13, 2026. Eligible Enterprise and Education editions remain supported and receive KB5132061.

Businesses should verify each device’s Windows edition and support status rather than relying solely on its version number.

TechRepublic previously explained what Windows 11 users should do before support ends.

Eligible Windows 10 devices enrolled in Extended Security Updates may continue receiving security fixes, including November’s KB5131096.

Why November’s Patch Tuesday matters

Microsoft’s November release highlights a familiar challenge for IT departments: the number of vulnerabilities requiring attention can be enormous, but the risks are rarely equal.

The Outlook zero-day illustrates that distinction. Its CVSS score of 6.5 might not stand out among dozens of Critical vulnerabilities, yet Microsoft has confirmed active exploitation.

For organizations managing hundreds or thousands of endpoints, that difference matters.

Businesses should prioritize patching vulnerable Outlook installations, reviewing exposure to NTLM authentication, and ensuring that supported Windows systems receive November’s updates.

The biggest risk is allowing a known, exploited weakness to remain available after a fix has been released.

Also read: For more on Microsoft’s efforts to strengthen Windows authentication, read TechRepublic’s guide to moving beyond NTLM, which explains the protocol’s security risks and how businesses can prepare for more secure alternatives.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts