Skip to content
OriginalSign in
Image: SOCRadar

SOCRadarYağmur Ernalbant

Microsoft fixes 1,094 flaws, including exploited Outlook zero day

Part of the CVE-2026-124194 story · since 10 Nov

Quiet for 3 dayslast report 11 Nov15 articles13 outlets
10 Nov · SecurityWeek first13 NovNowThis article14th of 15
  • Tue 10 Nov, 19:30 UTC. SecurityWeek, first report. Microsoft patches Outlook zero day exploited in the wild. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:31 UTC. CISA, its first report on the story. CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. SANS ISC, its first report on the story. Microsoft November 2027 update fixes 1,260 vulnerabilities. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. thezdi.com, its first report on the story. Adobe and Microsoft November updates fix over 1,200 flaws. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 22:30 UTC. Krebs on Security, its first report on the story. Microsoft fixes 1,093 flaws, including an exploited Outlook bug. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:01 UTC. SecurityOnline, its first report on the story. Microsoft fixes 1,093 flaws, including exploited Outlook zero-day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:30 UTC. SecurityOnline. Microsoft patches exploited Outlook spoofing zero day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:31 UTC. Dark Reading, its first report on the story. Microsoft fixes 1,093 flaws as Outlook zero day remains active. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 00:30 UTC. Rapid7, its first report on the story. Microsoft fixes exploited Outlook flaw in November Patch Tuesday. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 01:30 UTC. SecurityOnline. CISA adds six exploited flaws to its KEV catalogue. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 09:30 UTC. The Hacker News, its first report on the story. Microsoft patches 1,259 flaws, including exploited Outlook bug. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 10:02 UTC. Infosecurity, its first report on the story. Microsoft fixes 1,235 flaws, including exploited Outlook zero day. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 11:00 UTC. Security Affairs, its first report on the story. Microsoft patches exploited Outlook flaw and 30 wormable bugs. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 11:30 UTC. SOCRadar, its first report on the story. Microsoft fixes 1,094 flaws, including exploited Outlook zero day. Cites a CVE in CISA KEV. This article, 14th of 15.
  • Wed 11 Nov, 12:30 UTC. Malwarebytes, its first report on the story. Microsoft fixes Outlook flaw exploited to steal authentication data. Cites a CVE in CISA KEV.

Microsoft’s November 2026 Patch Tuesday, issued on 10 November 2026, fixes 1,094 vulnerabilities across Windows, Office, SQL Server, Exchange Server, SharePoint, Azure services and developer tools. The batch includes one zero-day, and more than 60 flaws rated Critical. The zero-day is CVE-2026-124194, an Outlook spoofing flaw that leaks NTLMv2 hashes; Microsoft notes the vulnerability is exploited, and the fix is delivered through Office updates rather than the Windows cumulative update.

CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on 10 November 2026 with a remediation deadline of 24 November 2026 for federal agencies, and the advisory indicates Office updates (Office 365 Apps for Enterprise and Office LTSC 2024) should be prioritised first, with Windows patches following for users who remain on Windows alone. Microsoft credits the discovery to a researcher who collaborated with Anthropic’s Claude.

Among the Critical fixes, 63 are rated as such, with the highest scores (9.8) for unauthenticated RCEs in Windows LDAP, Windows Search and the Xbox Live Networking Service. CVE-2026-116928, a Windows Search flaw reachable via Exchange Server without user interaction, requires both Windows and Exchange updates.

Other notable entries include CVE-2026-119958 (LDAP) and CVE-2026-119952 (Schannel), both unauthenticated network-accessible RCEs, along with a cluster of 8.1–8.8 rated RCEs across CredSSP, IIS, WDS and related services. SAP also issued four CVSS 10.0 notes on the same day (CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017), all unauthenticated.

How the story developed

All 15 articles
Quiet for 3 dayslast report 11 Nov15 articles13 outlets

15 articles from 13 outlets since 10 Nov. Quiet since 11 Nov. This was the 14th report, 16 hours after the first.

Now10 Nov11First reportSecurityWeek · 10 Nov, 19:30This article14th of 15 · day 1CISA alert10 Nov, 20:31 · official
  • Tue 10 Nov, 19:30 UTC. SecurityWeek, first report. Microsoft patches Outlook zero day exploited in the wild. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:31 UTC. CISA, its first report on the story. CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. SANS ISC, its first report on the story. Microsoft November 2027 update fixes 1,260 vulnerabilities. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. thezdi.com, its first report on the story. Adobe and Microsoft November updates fix over 1,200 flaws. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 22:30 UTC. Krebs on Security, its first report on the story. Microsoft fixes 1,093 flaws, including an exploited Outlook bug. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:01 UTC. SecurityOnline, its first report on the story. Microsoft fixes 1,093 flaws, including exploited Outlook zero-day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:30 UTC. SecurityOnline. Microsoft patches exploited Outlook spoofing zero day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:31 UTC. Dark Reading, its first report on the story. Microsoft fixes 1,093 flaws as Outlook zero day remains active. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 00:30 UTC. Rapid7, its first report on the story. Microsoft fixes exploited Outlook flaw in November Patch Tuesday. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 01:30 UTC. SecurityOnline. CISA adds six exploited flaws to its KEV catalogue. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 09:30 UTC. The Hacker News, its first report on the story. Microsoft patches 1,259 flaws, including exploited Outlook bug. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 10:02 UTC. Infosecurity, its first report on the story. Microsoft fixes 1,235 flaws, including exploited Outlook zero day. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 11:00 UTC. Security Affairs, its first report on the story. Microsoft patches exploited Outlook flaw and 30 wormable bugs. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 11:30 UTC. SOCRadar, its first report on the story. Microsoft fixes 1,094 flaws, including exploited Outlook zero day. Cites a CVE in CISA KEV. This article, 14th of 15.
  • Wed 11 Nov, 12:30 UTC. Malwarebytes, its first report on the story. Microsoft fixes Outlook flaw exploited to steal authentication data. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 15 articles as a list
  1. Tue 10 NovDay 08
    1. Microsoft patches Outlook zero day exploited in the wild19:30 · SecurityWeek · First report · Known exploited CVE
    2. CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV20:31 · CISA · official · CISA alert · Known exploited CVE
    3. Microsoft November 2027 update fixes 1,260 vulnerabilities21:00 · SANS ISC · Known exploited CVE
    Show 5 more from 10 Nov
    1. Adobe and Microsoft November updates fix over 1,200 flaws21:00 · thezdi.com · Known exploited CVE
    2. Microsoft fixes 1,093 flaws, including an exploited Outlook bug22:30 · Krebs on Security · Known exploited CVE
    3. Microsoft fixes 1,093 flaws, including exploited Outlook zero-day23:01 · SecurityOnline · Known exploited CVE
    4. Microsoft patches exploited Outlook spoofing zero day23:30 · SecurityOnline · Known exploited CVE
    5. Microsoft fixes 1,093 flaws as Outlook zero day remains active23:31 · Dark Reading · Known exploited CVE
  2. Wed 11 NovDay 17
    1. Microsoft fixes exploited Outlook flaw in November Patch Tuesday00:30 · Rapid7 · Known exploited CVE
    2. CISA adds six exploited flaws to its KEV catalogue01:30 · SecurityOnline · Known exploited CVE
    3. Microsoft fixes 1,094 flaws, including exploited Outlook zero day11:30 · SOCRadar · Known exploited CVE · This article, 14th of 15
    Show 4 more from 11 Nov
    1. Microsoft patches 1,259 flaws, including exploited Outlook bug09:30 · The Hacker News · Known exploited CVE
    2. Microsoft fixes 1,235 flaws, including exploited Outlook zero day10:02 · Infosecurity · Known exploited CVE
    3. Microsoft patches exploited Outlook flaw and 30 wormable bugs11:00 · Security Affairs · Known exploited CVE
    4. Microsoft fixes Outlook flaw exploited to steal authentication data12:30 · Malwarebytes · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in