Skip to content
OriginalConnect AISign inSign up free
Image: Rapid7

Rapid7Adam Barnett

Microsoft fixes exploited Outlook flaw in November Patch Tuesday

Part of the CVE-2026-124194 story · since 10 Nov

Quiet for 4 dayslast report 11 Nov15 articles13 outlets
10 Nov · SecurityWeek first14 Nov15 NovNowThis article9th of 15
  • Tue 10 Nov, 19:30 UTC. SecurityWeek, first report. Microsoft patches Outlook zero day exploited in the wild. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:31 UTC. CISA, its first report on the story. CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. SANS ISC, its first report on the story. Microsoft November 2027 update fixes 1,260 vulnerabilities. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. thezdi.com, its first report on the story. Adobe and Microsoft November updates fix over 1,200 flaws. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 22:30 UTC. Krebs on Security, its first report on the story. Microsoft fixes 1,093 flaws, including an exploited Outlook bug. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:01 UTC. SecurityOnline, its first report on the story. Microsoft fixes 1,093 flaws, including exploited Outlook zero-day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:30 UTC. SecurityOnline. Microsoft patches exploited Outlook spoofing zero day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:31 UTC. Dark Reading, its first report on the story. Microsoft fixes 1,093 flaws as Outlook zero day remains active. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 00:30 UTC. Rapid7, its first report on the story. Microsoft fixes exploited Outlook flaw in November Patch Tuesday. Cites a CVE in CISA KEV. This article, 9th of 15.
  • Wed 11 Nov, 01:30 UTC. SecurityOnline. CISA adds six exploited flaws to its KEV catalogue. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 09:30 UTC. The Hacker News, its first report on the story. Microsoft patches 1,259 flaws, including exploited Outlook bug. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 10:02 UTC. Infosecurity, its first report on the story. Microsoft fixes 1,235 flaws, including exploited Outlook zero day. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 11:00 UTC. Security Affairs, its first report on the story. Microsoft patches exploited Outlook flaw and 30 wormable bugs. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 11:30 UTC. SOCRadar, its first report on the story. Microsoft fixes 1,094 flaws, including exploited Outlook zero day. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 12:30 UTC. Malwarebytes, its first report on the story. Microsoft fixes Outlook flaw exploited to steal authentication data. Cites a CVE in CISA KEV.

Patch Tuesday for November 2026 sees Microsoft publishing 1,092 of its own vulnerabilities across its products, including 1,102 in Windows, according to Rapid7. The firm notes that, despite the unprecedented volume this year, there has been no corresponding rise in vulnerabilities exploited in the wild; exploitation in the wild is known for just one vulnerability disclosed today, with no publicly disclosed exploit in November 2026.

The report also highlights that certain fixes address high‑risk, pre‑auth risk scenarios, alongside ongoing Microsoft lifecycle updates such as continued movement of .NET 8 LTS and PowerShell 7.4 LTS into lifecycle phases as of 11 November 2026.

Notable entries include Outlook: CVE-2026-124194, described as an exploited‑in‑the‑wild spoofing vulnerability that can cause Outlook to leak an NTLM v2 hash when a specially crafted malicious file is opened; the NTLM hash can be relayed or cracked offline, with the Preview Pane not being a vector. Windows Schannel faces CVE-2026-119952, a pre‑auth RCE in TLS’ Schannel component, with exploitability contingent on the vulnerable service and execution context potentially being SYSTEM in some cases.

Exchange/Windows Search expose CVE-2026-116928, enabling pre‑auth RCE on the server via a malicious attachment processed by Exchange. Rapid7 attributes these findings to Microsoft’s advisory guidance and notes the patches apply across supported Windows versions, with some dependency on broader service configurations such as Exchange deployment.

How the story developed

All 15 articles
Quiet for 4 dayslast report 11 Nov15 articles13 outlets

15 articles from 13 outlets since 10 Nov. Quiet since 11 Nov. This was the 9th report, 5 hours after the first.

Now10 Nov11First reportSecurityWeek · 10 Nov, 19:30This article9th of 15 · day 1
  • Tue 10 Nov, 19:30 UTC. SecurityWeek, first report. Microsoft patches Outlook zero day exploited in the wild. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:31 UTC. CISA, its first report on the story. CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. SANS ISC, its first report on the story. Microsoft November 2027 update fixes 1,260 vulnerabilities. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. thezdi.com, its first report on the story. Adobe and Microsoft November updates fix over 1,200 flaws. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 22:30 UTC. Krebs on Security, its first report on the story. Microsoft fixes 1,093 flaws, including an exploited Outlook bug. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:01 UTC. SecurityOnline, its first report on the story. Microsoft fixes 1,093 flaws, including exploited Outlook zero-day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:30 UTC. SecurityOnline. Microsoft patches exploited Outlook spoofing zero day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:31 UTC. Dark Reading, its first report on the story. Microsoft fixes 1,093 flaws as Outlook zero day remains active. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 00:30 UTC. Rapid7, its first report on the story. Microsoft fixes exploited Outlook flaw in November Patch Tuesday. Cites a CVE in CISA KEV. This article, 9th of 15.
  • Wed 11 Nov, 01:30 UTC. SecurityOnline. CISA adds six exploited flaws to its KEV catalogue. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 09:30 UTC. The Hacker News, its first report on the story. Microsoft patches 1,259 flaws, including exploited Outlook bug. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 10:02 UTC. Infosecurity, its first report on the story. Microsoft fixes 1,235 flaws, including exploited Outlook zero day. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 11:00 UTC. Security Affairs, its first report on the story. Microsoft patches exploited Outlook flaw and 30 wormable bugs. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 11:30 UTC. SOCRadar, its first report on the story. Microsoft fixes 1,094 flaws, including exploited Outlook zero day. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 12:30 UTC. Malwarebytes, its first report on the story. Microsoft fixes Outlook flaw exploited to steal authentication data. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 15 articles as a list
  1. Tue 10 NovDay 08
    1. Microsoft patches Outlook zero day exploited in the wild19:30 · SecurityWeek · First report · Known exploited CVE
    2. CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV20:31 · CISA · official · CISA alert · Known exploited CVE
    3. Microsoft November 2027 update fixes 1,260 vulnerabilities21:00 · SANS ISC · Known exploited CVE
    Show 5 more from 10 Nov
    1. Adobe and Microsoft November updates fix over 1,200 flaws21:00 · thezdi.com · Known exploited CVE
    2. Microsoft fixes 1,093 flaws, including an exploited Outlook bug22:30 · Krebs on Security · Known exploited CVE
    3. Microsoft fixes 1,093 flaws, including exploited Outlook zero-day23:01 · SecurityOnline · Known exploited CVE
    4. Microsoft patches exploited Outlook spoofing zero day23:30 · SecurityOnline · Known exploited CVE
    5. Microsoft fixes 1,093 flaws as Outlook zero day remains active23:31 · Dark Reading · Known exploited CVE
  2. Wed 11 NovDay 17
    1. Microsoft fixes exploited Outlook flaw in November Patch Tuesday00:30 · Rapid7 · Known exploited CVE · This article, 9th of 15
    2. CISA adds six exploited flaws to its KEV catalogue01:30 · SecurityOnline · Known exploited CVE
    3. Microsoft patches 1,259 flaws, including exploited Outlook bug09:30 · The Hacker News · Known exploited CVE
    Show 4 more from 11 Nov
    1. Microsoft fixes 1,235 flaws, including exploited Outlook zero day10:02 · Infosecurity · Known exploited CVE
    2. Microsoft patches exploited Outlook flaw and 30 wormable bugs11:00 · Security Affairs · Known exploited CVE
    3. Microsoft fixes 1,094 flaws, including exploited Outlook zero day11:30 · SOCRadar · Known exploited CVE
    4. Microsoft fixes Outlook flaw exploited to steal authentication data12:30 · Malwarebytes · Known exploited CVE

Sources

CyberSIXTSignal over noise
Sign inSign up free

Updated