Outlook zero-day CVE-2026-124194, Digi Mart USA News: Microsoft released its monthly security updates for Windows, Office and other products on November 10, 2026. One of the fixed flaws is in Outlook, and Microsoft says attackers are already exploiting it. The vulnerability is tracked as CVE-2026-124194.
The Microsoft advisory credits a researcher who goes by “nono” along with Benoît Sevens, whose acknowledgment reads “using Claude with Anthropic”. Microsoft classifies the bug as a spoofing vulnerability, rates it Moderate and gives it a CVSS score of 6.5.
According to Microsoft, an attacker sends a specially crafted message file and gets the victim to open it in Outlook. Outlook then connects to a server the attacker controls without showing the usual warning about external content.
Microsoft says the flaw “discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user.” The Preview Pane is not an attack vector, so the file has to be opened. Microsoft has not shared details about the attacks.
The advisory lists Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 as affected. Office 2016 and Office 2019 are not on the list, but neither has received security updates since October 2025.
Tenable counts 1,093 Microsoft CVEs in this release, 63 of them rated Critical, while SecurityWeek counts 1,094. Microsoft’s Security Update Guide lists more entries because it also includes third-party flaws such as those in Chromium. SecurityWeek reported that Microsoft fixed a record 1,413 vulnerabilities in October.
Brian Krebs notes that a year ago Microsoft was averaging around 100 patches per month and says the company credits advances in AI for helping find and fix more bugs.
On Windows 11, users can open Settings and go to Windows Update to install the November update, KB5132061. Office usually updates automatically. Users who do not want to wait can open Outlook, go to File, Office Account, Update Options and click Update Now.
According to the publisher, build 16.0.17932.21140 contains the fix for Office LTSC 2024, and build 16.0.14334.21048 for Office LTSC 2021.
Until the update is installed, users should avoid opening message files or Office documents from unexpected emails, even if the sender looks familiar. Krebs also recommends backing up important data before applying operating system updates.
