Skip to content
OriginalSign in
Image: Dark Reading

Dark ReadingTara Seals

Microsoft fixes 1,093 flaws as Outlook zero day remains active

Part of the CVE-2026-124194 story · since 10 Nov

Developinglatest 26 minutes ago8 articles7 outlets
10 Nov · SecurityWeek firstNowThis article8th of 8
  • Tue 10 Nov, 19:30 UTC. SecurityWeek, first report. Microsoft patches Outlook zero day exploited in the wild. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:31 UTC. CISA, its first report on the story. CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. SANS ISC, its first report on the story. Microsoft November 2027 update fixes 1,260 vulnerabilities. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. thezdi.com, its first report on the story. Adobe and Microsoft November updates fix over 1,200 flaws. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 22:30 UTC. Krebs on Security, its first report on the story. Microsoft fixes 1,093 flaws, including an exploited Outlook bug. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:01 UTC. SecurityOnline, its first report on the story. Microsoft fixes 1,093 flaws, including exploited Outlook zero-day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:30 UTC. SecurityOnline. Microsoft patches exploited Outlook spoofing zero day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:31 UTC. Dark Reading, its first report on the story. Microsoft fixes 1,093 flaws as Outlook zero day remains active. Cites a CVE in CISA KEV. This article, 8th of 8.

On 10 November 2026, Microsoft released its second four-digit Patch Tuesday in a row, addressing 1,093 security vulnerabilities across Windows, Exchange, SharePoint, and related components. The highlight is a still-active Outlook zero‑day, CVE-2026-124194, described by researchers as a spoofing flaw that may allow disclosure of an NTLMv2 hash even if code execution is not gained. Exploitation activity has been observed, and defenders are urged to prioritise this patch alongside other high‑risk fixes.

Automox and Tenable’s analysts emphasised prioritising internet-facing and widely exposed services first, given the likelihood of targeted exploitation.

Other notable fixes include two critical RCE vulnerabilities: CVE-2026-118207 in Exchange Server (CVSS 8.8) and CVE-2026-120002 in SharePoint Server (CVSS 9.9). In both cases, an authenticated attacker with low privileges could run code or escalate to higher privileges with minimal user interaction.

Additional critical flaws to watch are CVE-2026-110043, a one‑click heap-based buffer overflow in Outlook via the Preview Pane (CVSS 8.8/10), and CVE-2026-116928 in Windows Search (CVSS 9.8), described as wormable and requiring urgent patching for Exchange‑connected servers. LDAP and LDAP-related exposure are also noted: CVE-2026-119958 addresses an unauthenticated out-of-bounds write in LDAP that could be highly damaging on Domain Controllers.

The report stresses rapid testing and deployment of these patches, particularly for network-facing services such as DNS, DHCP, LDAP, Exchange, and Office components. Security researchers quoted in the piece caution that the workload remains substantial and that prioritisation should be guided by exposure, exploitation in the wild, and relevance to specific environments.

How the story developed

All 8 articles
Developinglatest 26 minutes ago8 articles7 outlets

8 articles from 7 outlets since 10 Nov. Still developing; the latest report was 26 minutes ago. This was the 8th report, 4 hours after the first.

Now10 NovFirst reportSecurityWeek · 10 Nov, 19:30This article8th of 8 · day 0
  • Tue 10 Nov, 19:30 UTC. SecurityWeek, first report. Microsoft patches Outlook zero day exploited in the wild. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:31 UTC. CISA, its first report on the story. CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. SANS ISC, its first report on the story. Microsoft November 2027 update fixes 1,260 vulnerabilities. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. thezdi.com, its first report on the story. Adobe and Microsoft November updates fix over 1,200 flaws. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 22:30 UTC. Krebs on Security, its first report on the story. Microsoft fixes 1,093 flaws, including an exploited Outlook bug. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:01 UTC. SecurityOnline, its first report on the story. Microsoft fixes 1,093 flaws, including exploited Outlook zero-day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:30 UTC. SecurityOnline. Microsoft patches exploited Outlook spoofing zero day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:31 UTC. Dark Reading, its first report on the story. Microsoft fixes 1,093 flaws as Outlook zero day remains active. Cites a CVE in CISA KEV. This article, 8th of 8.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 8 articles as a list
  1. Tue 10 NovDay 08
    1. Microsoft patches Outlook zero day exploited in the wild19:30 · SecurityWeek · First report · Known exploited CVE
    2. CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV20:31 · CISA · official · CISA alert · Known exploited CVE
    3. Microsoft fixes 1,093 flaws as Outlook zero day remains active23:31 · Dark Reading · Known exploited CVE · This article, 8th of 8
    Show 5 more from 10 Nov
    1. Microsoft November 2027 update fixes 1,260 vulnerabilities21:00 · SANS ISC · Known exploited CVE
    2. Adobe and Microsoft November updates fix over 1,200 flaws21:00 · thezdi.com · Known exploited CVE
    3. Microsoft fixes 1,093 flaws, including an exploited Outlook bug22:30 · Krebs on Security · Known exploited CVE
    4. Microsoft fixes 1,093 flaws, including exploited Outlook zero-day23:01 · SecurityOnline · Known exploited CVE
    5. Microsoft patches exploited Outlook spoofing zero day23:30 · SecurityOnline · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in