Microsoft's November 2026 Patch Tuesday Updates Fixes 1200+ Vulnerabilities, Including Exploited Outlook Zero-Day

Microsoft has fixed over thousand vulnerabilities with November 2026 Patch Tuesday updates, including an actively exploited Microsoft Outlook zero-day. The vulnerability could expose users’ authentication credentials after opening a specially crafted malicious file.

Outlook zero-day could expose Windows authentication credentials

Tracked as CVE-2026-124194, the vulnerability affects Microsoft Outlook and carries a CVSS severity score of 6.5. Microsoft classifies it as a spoofing vulnerability and confirms that attackers have exploited it.

The problem stems from Outlook failing to warn users before a potentially unsafe action takes place. An attacker can send a specially crafted message file and convince a victim to open it.

Once opened, Outlook may connect to an attacker-controlled network location without displaying its usual external-content warning. This can expose the victim’s NTLMv2 authentication hash, which attackers may attempt to crack or relay.

In simpler terms, hackers could potentially use the stolen authentication information to impersonate victims. That makes the vulnerability especially concerning for organizations relying on Windows authentication.

As of now, Microsoft has not shared details about the attacks or identified the threat actors. The vulnerability also requires user interaction and network connectivity, meaning simply receiving a malicious file isn’t enough.

Microsoft fixes more than 1200 security vulnerabilities

The Outlook zero-day is only one part of November’s security release. Microsoft’s latest Patch Tuesday addresses 1,235 vulnerabilities, including 66 rated Critical. Microsoft also addresses numerous remote code execution and privilege escalation vulnerabilities across Windows, Office, Exchange Server, and other products.

In case you are unaware, Windows 11 KB5132061 November 2026 Patch Tuesday update is repprtedly triggering multiple errors for users during download and installation, though some potential fixes have been reported.

via: Bleeping Computer, SecurityWeek, CrowdStrike