Microsoft Update Fixes Over 1,000 Flaws, Including Exploited Outlook Bug

Microsoft’s November security update addresses more than 1,000 vulnerabilities, including an Outlook flaw the company says is being actively exploited. The vulnerability can expose authentication information when a user opens a specially crafted message file, according to Microsoft’s advisory.

The flaw, identified as CVE-2026-124194, affects Microsoft Outlook. Microsoft says an attacker can send a crafted file and persuade a user to open it; Outlook may then connect to an attacker-controlled network location without displaying its usual external-content warning. That connection could disclose information such as an NTLMv2 hash, which could be used to impersonate the user. Exploitation requires network connectivity and user interaction.

Microsoft rates the flaw as moderate, with a CVSS score of 6.5, but flags it as actively exploited. The reports say the attacker’s identity and the technical details of observed attacks have not been disclosed. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog. Federal agencies are required to apply the fix by November 24, 2026.

The vulnerability counts for the November...