Science & Tech · Cybersecurity · 2 hrs ago
Microsoft’s November Patch Tuesday includes an exploited Outlook flaw
Microsoft disclosed more than 1,000 vulnerabilities in its November Patch Tuesday release, including 63 rated critical.
One was an Outlook flaw that Microsoft said attackers were exploiting, and the company warned that opening a specially crafted file could expose authentication information.
The flaw could let an attacker impersonate a user, according to a security researcher cited in the coverage.
The US Cybersecurity and Infrastructure Security Agency ordered federal agencies to patch the Outlook flaw by the end of November; it also set a Friday deadline for two exploited vulnerabilities in Barracuda email security products.
The sources give different totals for Microsoft’s vulnerabilities: one says 1,093, while the other says the Windows 10 update addresses 1,235 across Microsoft products.
N-able took hosted N-central systems offline after researchers found more than 30 serious vulnerabilities, and told customers to turn off their servers; the company said it had no evidence of successful attacks.
Windows 10 users covered by the update can install it through Windows Update, while N-able customers’ access to hosted N-central remains unavailable during the shutdown.
Microsoft’s November 2026 Patch Tuesday addressed vulnerabilities across its products, including an actively exploited Outlook zero-day.
BleepingComputer reported 1,235 flaws were addressed, while The Record reported 1,093 bugs disclosed.
The Outlook flaw, CVE-2026-124194, could let an attacker prompt a user to open a specially crafted message file and potentially expose authentication information.
CISA added the flaw to its Known Exploited Vulnerabilities catalog and told federal agencies to patch it by the end of the month.
Microsoft also released a Windows 10 update with the month’s security fixes and several bug fixes.
- Who
- Microsoft released the fixes. CISA directed federal agencies to patch the exploited Outlook flaw.
- What
- Microsoft addressed vulnerabilities, including an actively exploited Outlook zero-day, CVE-2026-124194.
- When
- November 10, 2026, according to the articles’ publication dates and descriptions of that day’s Patch Tuesday.
- Where
- The vulnerability affects Microsoft Outlook. The sources do not state where the exploitation occurred.
- Why
- To address security flaws, including one reported as actively exploited. The sources do not state who carried out the exploitation or their motive.
This story does not have two clearly opposing sides.
Microsoft released an emergency update to fix some Windows 10 audio issues.
Microsoft’s November Patch Tuesday fixes were reported, including fixes for the exploited Outlook vulnerability.
CISA required federal agencies to patch CVE-2026-124194.
- Flaws addressed
- 1,235, according to BleepingComputer; The Record reported 1,093 disclosed
- Outlook vulnerability
- CVE-2026-124194
- Severity score
- 6.5
- Discoverer
- Benoît Sevens, using Anthropic’s Claude, according to Microsoft
- Windows 10 update
- KB5131096
4 sources
What people are saying
could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook.
Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user
As expected, we are observing scanning activity associated with the published proof-of-concept code. At this time, we have no evidence that any customer environment has been successfully exploited.
Posts on X
Security updates for November 2026 are now available. Details are here: https://t.co/WW89TchdN8 #PatchTuesday #SecurityUpdateGuide