Microsoft’s November Patch Tuesday update has fixed 1,094 vulnerabilities across its products, including a zero-day exploit in Outlook that has been actively used by attackers. This marks another significant milestone for Microsoft, which has now patched over 5,000 vulnerabilities this year alone.
The exploited Outlook bug, tracked as CVE-2026-124194, is a spoofing flaw that allows an attacker to trick the user into opening a malicious file without warning. According to Microsoft, the victim needs to be convinced to open a specially crafted message file, which would then cause Outlook to connect to an attacker-controlled network location and potentially disclose authentication information that could be used to impersonate the user.
Microsoft has assigned this vulnerability a moderate severity rating and a CVSS score of 6.5. While it’s unclear how many users have been affected by this exploit, Microsoft notes that the flaw cannot be triggered through the Preview Pane. The company also clarified that the attack discloses a user’s NTLMv2 hash to the attacker, which could be used for further malicious activities.
This vulnerability was not publicly disclosed before the fix became available, and it affects several products, including Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The researchers who discovered this flaw have been credited by Microsoft as ‘nono’ and Benoit Sevens, with the latter using Anthropic’s Claude AI model in his research.
In addition to addressing the Outlook exploit, Microsoft has also fixed numerous other vulnerabilities across its products, including Windows (726 fixes), Office (174 fixes), SQL Server (59 fixes), developer tools (53 fixes), SharePoint Server (27 fixes), Azure (20 fixes), and Exchange Server (9 fixes). The company has also republished 165 CVEs from third parties.
This month’s updates are notable for being the final ones for the Enterprise and Education editions of Windows 11 version 23H2, as devices running these editions will no longer receive monthly security updates. Microsoft’s release summary lists critical-severity updates for several products, including Windows 10, Windows 11, Windows Server, Office, Exchange Server Subscription Edition, Edge, and the Malware Protection Engine.
The sheer number of vulnerabilities patched by Microsoft this month is a stark reminder of the ongoing cat-and-mouse game between security researchers and attackers. As we move forward in this complex landscape, it’s essential for users to stay vigilant and keep their software up-to-date with the latest patches. By doing so, they can significantly reduce their risk of falling victim to these types of attacks.
Source: SecurityWeek — 2026-11-10