Key Takeaways
- Microsoft fixed CVE-2026-124194, a Microsoft Outlook flaw it marks as exploited in attacks, in its November 2026 security updates released on November 10, 2026.
- CVE-2026-124194 lets an attacker who gets a user to open a crafted message file in Outlook obtain the user's NTLMv2 hash, which Microsoft says the attacker could use to authenticate as that user.
- CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10, 2026, and set a patch deadline of November 24, 2026, for federal agencies.
- Microsoft's November 2026 release fixed more than 1,000 vulnerabilities, with counts of 1,093 by The Record, 1,094 by The Register, and 1,235 by BleepingComputer, whose count includes Microsoft Edge flaws.
What happened
Microsoft released its November 2026 security updates on November 10, 2026. One of the flaws they fix, CVE-2026-124194 in Microsoft Outlook, was exploited in attacks, according to Microsoft's security advisory, which lists the flaw as exploited and not publicly disclosed. Because attackers used it before a fix was available, it counts as a zero-day under Microsoft's own definition, BleepingComputer reported.
Microsoft calls CVE-2026-124194 a spoofing vulnerability and rates it moderate, with a score of 6.5 out of 10. Microsoft did not say when the attacks started, who carried them out, or what the attackers did with the access, The Register reported.
Microsoft credits the discovery to "Benoît Sevens using Claude with Anthropic" in the advisory's acknowledgements. The Record also reported that Microsoft said the bug was found by Sevens using Anthropic's Claude.
What the Outlook flaw does
According to Microsoft, an attacker sends a specially crafted message file and convinces the user to open it in an affected version of Outlook. Opening the file can make Outlook connect to a network location the attacker controls without showing the usual external-content warning.
That connection gives away the user's NTLMv2 hash, a piece of Windows login data, and Microsoft said the attacker "could use this to authenticate as the user." The Outlook preview pane is not a way in, Microsoft said; the user has to open the file.
"It's labeled spoofing, but the impact is bigger than the name suggests," Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative, said in his monthly review, The Register reported. Satnam Narang of Tenable said an attack using the flaw may let someone sign in as the targeted user, according to The Record. Similar flaws have been exploited in the past, usually through attachments sent in phishing emails, BleepingComputer reported.
Who is affected
Microsoft lists three products as affected: Microsoft 365 Apps for Enterprise, Office LTSC 2024, and Office LTSC 2021, in 32-bit and 64-bit editions. The fixed build is 16.0.17932.21140 for Office LTSC 2024 and 16.0.14334.21048 for Office LTSC 2021. For Microsoft 365 Apps, Microsoft points to its Office security release notes for the fixed builds.
CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities (KEV) catalog, the agency's list of flaws known to be used in attacks, on November 10, 2026. The KEV entry sets a remediation deadline of November 24, 2026, for federal agencies.
The rest of the November release
Outlets counted the release differently. The Record counted 1,093 flaws, The Register 1,094, and BleepingComputer 1,235, a figure that includes 142 flaws in the Microsoft Edge browser. It is the second month in a row above 1,000, The Record reported. Narang said the release brings Microsoft to more than 5,160 vulnerabilities disclosed in 2026, according to The Record.
CVE-2026-124194 is the only flaw in the release that Microsoft lists as exploited. Two others are rated critical by Microsoft, with scores of 9.8 out of 10, and need no action from a user, The Register reported:
-
•
CVE-2026-116928, in the Windows Search component that Microsoft Exchange Server uses, lets an attacker run code by sending an email with a crafted attachment. Exchange processes the attachment for indexing on its own, so "the recipient does not need to open the email or attachment," Microsoft said.
-
•
CVE-2026-119958, in Windows LDAP (Lightweight Directory Access Protocol), lets an attacker who has not logged in run code through crafted LDAP requests.
Microsoft rates exploitation of both as less likely. Childs counted 30 flaws in the release that pose a "wormable risk," meaning they need no login and no user interaction over a network, The Register reported.
What organizations should do
Microsoft's fix for CVE-2026-124194 is the November 10 security update for each affected Office product, listed in its advisory. Childs warned against letting the flaw's moderate score or its spoofing label lead organizations to put off the patch, according to The Register.
"Logging back-to-back months above 1,000 CVEs proves automated bug-hunting has permanently reset patch volume," Childs told The Register. "With AI making patch-diffing and exploit generation near-instant, the threat window opens the minute these updates drop."