A maliciously crafted Outlook file could cause the application to connect to an attacker-controlled server and reveal authentication information. Microsoft fixed the flaw, identified as CVE-2026-124194, in its November security update, a release containing more than 1,000 vulnerabilities according to the various published counts.
The issue does not require the victim to enter their credentials, but they must open the file and the computer must have a network connection. Microsoft classifies the flaw as moderate severity, with a CVSS score of 6.5, and identifies it as actively exploited. The company has not said who is behind the attacks or published technical details about their activity.
Opening a file can expose authentication
According to Microsoft's description, an unauthenticated attacker can send a specially crafted message file and convince the recipient to open it in an affected version of Outlook. The application then connects to a network location controlled by the attacker without displaying the usual external content warning.
That connection can reveal authentication information, including an NTLMv2 hash. BleepingComputer explains that Windows may attempt to authenticate automatically when connecting to a remote network resource; the attacker could capture the hash and try to crack it offline. If the attacker recovers the credentials, they could use them to try to access corporate accounts.
The attack requires user interaction: simply receiving the message is not enough. ReconX Watchtower also specifies that the preview pane is not an attack vector. The described risk occurs when the person opens the crafted message file and Outlook makes the connection.
“A captured hash can let an attacker sign in as the victim, read their data, and move to other systems they can reach.”
— Jack Bicer, director of vulnerability research at Action1
Patch Tuesday counts don't match
Published counts for the November fixes differ. The Hacker News attributes patches for 1,259 vulnerabilities to Microsoft; BleepingComputer counts 1,235 in Patch Tuesday; and Tenable records 1,093 CVEs. The publications do not use exactly the same scope: BleepingComputer says its Patch Tuesday count excludes 108 flaws fixed earlier in the month, while its full list includes them.
| Publication | November count | Scope details |
|---|---|---|
| The Hacker News | 1,259 vulnerabilities | Includes 165 CVE identifiers that were not issued by Microsoft. |
| BleepingComputer | 1,235 flaws | The Patch Tuesday count excludes 108 flaws fixed earlier in the month. |
| Tenable | 1,093 CVEs | Includes fixes for 287 products and components. |
The differences do not change the shared takeaway: all three publications describe an exceptionally large round of fixes and identify CVE-2026-124194 as the exploited Outlook flaw. Tenable breaks down its 1,093 CVEs into 63 critical, 1,029 important, and one moderate. In its analysis, privilege escalation flaws account for 48.9% and remote code execution flaws for 27.1%.
BleepingComputer counts 66 critical vulnerabilities in its tally of 1,235, of which 48 are remote code execution flaws, 15 are privilege escalation flaws, and three are use-after-free issues in Microsoft Edge. It also estimates 536 privilege escalation flaws, 296 remote code execution flaws, 157 information disclosure flaws, 46 denial-of-service flaws, and 22 spoofing flaws. Its breakdown includes 142 vulnerabilities in Chromium-based Microsoft Edge and about 639 associated with Windows or its components.
Second consecutive month above one thousand
According to The Hacker News, this is the second consecutive update with more than 1,000 flaws. BleepingComputer puts October's release at 1,411 vulnerabilities, higher than November's figure in its own counts. The publication also notes that Microsoft has attributed some of its recent ability to find and fix vulnerabilities to advances in artificial intelligence.
Satnam Narang, a senior researcher at Tenable, puts the number of CVEs fixed by Microsoft so far this year at more than 5,100. Krebs on Security also says the company has released more than 5,100 patches in 2026 and reports that Microsoft links the higher volume of recent fixes to advances in AI. These are year-to-date totals, not the number of flaws in the November release.
The Hacker News says that more than 500 of the flaws in its count involve privilege escalation, and that the release also includes remote code execution and information disclosure vulnerabilities. Its product figures include 726 flaws in Windows, 174 in Office, and 59 in SQL Server, among other groups; the publication gives two different figures for Developer Tools, so it does not provide a complete breakdown consistent with the total of 1,259.
Other notable flaws in Windows and Azure
Among the issues highlighted by The Hacker News are remote code execution vulnerabilities in Windows Search (CVE-2026-116928), LDAP (CVE-2026-119958), Windows Schannel (CVE-2026-119952), Windows Virtual Filtering Platform (CVE-2026-95962), and Windows Xbox Live Networking Service (CVE-2026-112967). It also points to a privilege escalation flaw in Azure OpenAI, CVE-2026-119990.
Tenable adds other critical-severity cases. CVE-2026-118146, with a CVSSv3 score of 8.8, affects Active Directory Domain Services and could allow an authenticated attacker to execute code over the network. CVE-2026-118207 affects Exchange Server, also has a score of 8.8, and could allow code execution through a malformed input, according to Tenable's analysis.
For Windows Schannel, Tenable assigns CVE-2026-119952 a score of 8.1 and classifies it as critical: an unauthenticated attacker could execute code over the network by exploiting an observable timing discrepancy. In SharePoint, CVE-2026-120002 has a score of 9.9 and allows an authenticated attacker to escalate privileges, although Tenable considers exploitation less likely.
CISA sets a deadline for federal agencies
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-124194 to its Known Exploited Vulnerabilities (KEV) catalog. That listing requires U.S. federal agencies to install the fix by November 24, 2026.
Microsoft credited the discovery to a researcher named Nono and Benoît Sevens of Anthropic, who used Claude. Tenable also notes that Microsoft's advisory credits the discovery to a researcher who used Claude, but does not specify a model version. Microsoft has not clarified whether the research took place before or after exploitation began, or linked the attacks to a specific actor.
The ReconX Watchtower advisory lists Microsoft 365 Apps for enterprise, Office LTSC 2021, and Office LTSC 2024 among the affected products. For LTSC 2024, the fixed build is 16.0.17932.21140; for LTSC 2021, it is 16.0.14334.21048. For Microsoft 365 Apps for enterprise, the build depends on the update channel. ReconX says Microsoft did not publish a workaround: installing the update is the available fix.
Jake Knott, head of threat intelligence at watchTowr, described the pressure created by the volume of flaws and recommended prioritizing internet-facing systems and vulnerabilities already being exploited before reviewing the rest. The warning for Outlook is more immediate: the flaw is already listed in the KEV catalog, and a fix is available.
Sources: The Hacker News, krebsonsecurity.com, BleepingComputer, Tenable®, ReconX Watchtower
