Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft

According to SecurityWeek, the zero-day, tracked as CVE-2026-124194, has been classified as a spoofing flaw and stems from Outlook not alerting users before a potentially dangerous action takes place.[1] The outlet says Microsoft gave it a severity rating of 'moderate' and a CVSS score of 6.5.[1]Microsoft warns that "an unauthenticated attacker could send a specially crafted message file and convince a user to open it,"[2] BleepingComputer reports. BleepingComputer adds that the flaw was actively exploited in attacks to steal NTLM account hashes.[2]The Register reports that Microsoft didn't say when the attacks started, who is battering this bug, and what they are doing with the access[3].Splashtop says the fix is not part of the Windows cumulative update (KB5132061), so organizations that deploy only Windows updates remain exposed until the Office update is installed.[4] According to Splashtop, CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10, 2026, with a remediation due date of November 24[4].The Register reports two zero-click threats in this month's batch of fixes: CVE-2026-116928 and CVE-2026-119958.[3] BleepingComputer puts the count at a record-breaking 1,235 flaws[2], while SecurityWeek says the November release is smaller than October's, when Microsoft patched a record 1,413 vulnerabilities.[1]SecurityWeek also reports that this month's updates are also the final ones for the Enterprise and Education editions of Windows 11 version 23H2.[1]