Skip to content
OriginalSign in
Image: Krebs on Security

Krebs on SecurityBrianKrebs

Microsoft fixes 1,093 flaws, including an exploited Outlook bug

Part of the CVE-2026-124194 story · since 10 Nov

Developinglatest 36 minutes ago8 articles7 outlets
10 Nov · SecurityWeek firstNowThis article5th of 8
  • Tue 10 Nov, 19:30 UTC. SecurityWeek, first report. Microsoft patches Outlook zero day exploited in the wild. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:31 UTC. CISA, its first report on the story. CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. SANS ISC, its first report on the story. Microsoft November 2027 update fixes 1,260 vulnerabilities. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. thezdi.com, its first report on the story. Adobe and Microsoft November updates fix over 1,200 flaws. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 22:30 UTC. Krebs on Security, its first report on the story. Microsoft fixes 1,093 flaws, including an exploited Outlook bug. Cites a CVE in CISA KEV. This article, 5th of 8.
  • Tue 10 Nov, 23:01 UTC. SecurityOnline, its first report on the story. Microsoft fixes 1,093 flaws, including exploited Outlook zero-day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:30 UTC. SecurityOnline. Microsoft patches exploited Outlook spoofing zero day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:31 UTC. Dark Reading, its first report on the story. Microsoft fixes 1,093 flaws as Outlook zero day remains active. Cites a CVE in CISA KEV.

Microsoft has released a substantial Patch Tuesday, fixing 1,093 vulnerabilities across Windows and related software, including 63 rated as critical. The company says the batch represents more than five thousand patches in the year to date, and notes that almost half of the critical flaws are remote code execution bugs, with 535 of the total vulnerabilities enabling privilege escalation.

Among the flaws, Microsoft identifies one actively exploited item: CVE-2026-124194, a spoofing bug in Outlook affecting Microsoft 365 Apps for Enterprise and Microsoft Office editions. The firm emphasises that this is the sole flaw currently seen in active exploitation, with others not yet observed being exploited in the wild. The advisory suggests updating to mitigate risk across affected environments.

The broader ecosystem also issued updates this week: Google Chrome version 157.0.8103.50 fixes nine security holes, including CVE-2026-125350, the sixth zero‑day addressed in 2026 for Chrome (and for Chromium-based browsers such as Edge). Mozilla Firefox has a new release (Firefox 160) addressing close to 100 CVEs, about half of which are high severity.

Apple released out-of-cycle fixes across iOS/iPadOS, macOS, watchOS and visionOS, with reports highlighting iMessage flaws that could enable remote group chat participation and access to messages; Apple is said to have backported the iOS fix for 18. Neely, a SANS Institute instructor, urged upgrading older Apple devices to recent versions, noting multiple versions often require action.

Ivanti’s Chris Goettl warned enterprises face a deluge of patches, while emphasising that most of this year’s exploited vulnerabilities lie in core platforms and that asset exposure management should accompany patching. The report quotes ongoing guidance from CISA’s KEV list to prioritise actively exploited items.

How the story developed

All 8 articles
Developinglatest 36 minutes ago8 articles7 outlets

8 articles from 7 outlets since 10 Nov. Still developing; the latest report was 36 minutes ago. This was the 5th report, 3 hours after the first.

Now10 NovFirst reportSecurityWeek · 10 Nov, 19:30This article5th of 8 · day 0
  • Tue 10 Nov, 19:30 UTC. SecurityWeek, first report. Microsoft patches Outlook zero day exploited in the wild. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:31 UTC. CISA, its first report on the story. CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. SANS ISC, its first report on the story. Microsoft November 2027 update fixes 1,260 vulnerabilities. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 21:00 UTC. thezdi.com, its first report on the story. Adobe and Microsoft November updates fix over 1,200 flaws. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 22:30 UTC. Krebs on Security, its first report on the story. Microsoft fixes 1,093 flaws, including an exploited Outlook bug. Cites a CVE in CISA KEV. This article, 5th of 8.
  • Tue 10 Nov, 23:01 UTC. SecurityOnline, its first report on the story. Microsoft fixes 1,093 flaws, including exploited Outlook zero-day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:30 UTC. SecurityOnline. Microsoft patches exploited Outlook spoofing zero day. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:31 UTC. Dark Reading, its first report on the story. Microsoft fixes 1,093 flaws as Outlook zero day remains active. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 8 articles as a list
  1. Tue 10 NovDay 08
    1. Microsoft patches Outlook zero day exploited in the wild19:30 · SecurityWeek · First report · Known exploited CVE
    2. CISA Adds Actively Exploited Outlook Spoofing Flaw to KEV20:31 · CISA · official · CISA alert · Known exploited CVE
    3. Microsoft fixes 1,093 flaws, including an exploited Outlook bug22:30 · Krebs on Security · Known exploited CVE · This article, 5th of 8
    Show 5 more from 10 Nov
    1. Microsoft November 2027 update fixes 1,260 vulnerabilities21:00 · SANS ISC · Known exploited CVE
    2. Adobe and Microsoft November updates fix over 1,200 flaws21:00 · thezdi.com · Known exploited CVE
    3. Microsoft fixes 1,093 flaws, including exploited Outlook zero-day23:01 · SecurityOnline · Known exploited CVE
    4. Microsoft patches exploited Outlook spoofing zero day23:30 · SecurityOnline · Known exploited CVE
    5. Microsoft fixes 1,093 flaws as Outlook zero day remains active23:31 · Dark Reading · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in