Microsoft Patches 1,094 Flaws Including Exploited Outlook Zero-Day

Overview

• Microsoft’s November Patch Tuesday delivers 1,094 fixes across its products and includes an actively exploited Outlook vulnerability tracked as CVE-2026-124194.
• The Outlook flaw can cause the program to connect to an attacker-controlled network location when a user opens a specially crafted message file, which can disclose the user’s NTLMv2 authentication hash and enable impersonation.
• Microsoft rated the Outlook issue as moderate with a CVSS score of 6.5, said it was not publicly disclosed before the patch, and credited researchers 'nono' and Benoît Sevens with the discovery, noting Sevens used Anthropic’s Claude in analysis.
• The November package fixes 726 Windows flaws and 174 Office flaws, republishes 165 third-party CVEs, coincides with Adobe’s roughly 110-vulnerability update, and is the final monthly security update for Windows 11 23H2 Enterprise and Education editions.
• Security teams face heightened operational strain to triage and deploy fixes, prioritize exploited or high-risk remote code and credential-exposure bugs, and plan migrations or compensating controls for end-of-servicing systems.