Microsoft patches Outlook zero day exploited in the wild

Microsoft’s November 2026 Patch Tuesday patches 1,094 vulnerabilities across its software, including an Outlook zero-day that Microsoft says is being exploited in the wild. The flaw is tracked as CVE-2026-124194 and is classified as a spoofing vulnerability with a CVSS score of 6.5. Microsoft’s advisory states there is no information about observed attacks beyond noting exploitation, and the publication does not describe specific indicators of compromise.

The exploit requires an unauthenticated attacker to trick a user into opening a specially crafted message file in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication data that could be used to impersonate the user.

Microsoft notes the vulnerability cannot be triggered via the Preview Pane and discloses that it could expose a user’s NTLMv2 hash to the attacker, enabling authentication as the user. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.

Microsoft credits the discovery to a researcher using the moniker ‘nono’ and Benoît Sevens, with Sevens’ acknowledgement mentioning Anthropic’s Claude AI model. The release summary shows Windows leading the patched flaws (726), followed by Office (174), with further fixes in SQL Server, developer tools, SharePoint Server, Azure, and Exchange Server. This month’s Patch Tuesday also notes the end of monthly security updates for Windows 11 version 23H2 Enterprise and Education editions.