Microsoft has released a fix for an actively exploited Outlook vulnerability that can expose authentication information when a user opens a malicious file. Its November 10 advisory says attackers could use the information to impersonate the user, making the update a priority for organizations running affected Outlook versions.
The flaw, CVE-2026-124194, carries a Moderate severity rating and a Common Vulnerability Scoring System base score of 6.5 out of 10. Exploitation requires both network connectivity and a user opening the file. Microsoft explicitly says the Outlook Preview Pane is not an attack vector.
The fix is part of a large November security release. Microsoft’s release notes, dated November 11, list 1,094 Microsoft CVEs—identifiers assigned to vulnerabilities—and 165 republished non-Microsoft CVEs. Together, those account for the 1,259 entries reported by The Hacker News, which described November as the second consecutive month above 1,000.
How the Outlook attack works
An attacker needs no account or existing access to send a specially crafted message file and persuade someone to open it in a vulnerable Outlook installation. Opening it could make Outlook connect to an attacker-controlled network location without showing its usual external-content warning.
Microsoft says that connection can disclose the user’s NTLMv2 hash, authentication information an attacker could use to authenticate as the victim. The practical risk therefore extends beyond displaying misleading content: opening the file could expose information usable for impersonation.
Microsoft marked the vulnerability as exploited at its original publication on November 10 and as not previously publicly disclosed. The company credits nono and Benoît Sevens, using Claude with Anthropic, for reporting it.
The U.S. Cybersecurity and Infrastructure Security Agency added the Outlook flaw to its Known Exploited Vulnerabilities catalog on November 10, citing evidence of active exploitation. The Hacker News reports a November 24, 2026, remediation deadline for federal agencies; that requirement applies to Federal Civilian Executive Branch agencies, rather than organizations generally.
CISA’s alert describes Binding Operational Directive 26-04 as requiring those agencies to prioritize high-risk catalog vulnerabilities on publicly exposed assets that grant total control after exploitation, while deferring lower-risk vulnerabilities. It also establishes expectations for checking whether attackers compromised systems before patching. CISA encourages other organizations to prioritize cataloged vulnerabilities through risk-based vulnerability management.
Critical flaws also affect server processing
Several other November fixes address remote code execution, which can let an attacker run code on a vulnerable system. Three Microsoft advisories show why administrators need to consider the affected service and attack prerequisites alongside severity scores.
Windows Search: CVE-2026-116928. Microsoft rates this vulnerability Critical, with a base score of 9.8. Its advisory describes an out-of-bounds write—a memory operation outside its intended boundary—in the Windows Search component used by Microsoft Exchange Server.
An unauthenticated attacker could send an email containing a specially crafted attachment. Exchange automatically processes the attachment for indexing, so the recipient would not need to open either the email or attachment. Successful exploitation could run code with the permissions of the processing service. At publication, Microsoft recorded no exploitation or prior public disclosure and assessed exploitation as less likely.
Windows LDAP: CVE-2026-119958. This Critical vulnerability also has a base score of 9.8. LDAP, the Lightweight Directory Access Protocol, is used to access directory information. Microsoft’s advisory describes another out-of-bounds write: an unauthenticated attacker could send specially crafted LDAP calls and execute code in the LDAP service’s security context. No user interaction is required. Microsoft recorded no exploitation or prior public disclosure and assessed exploitation as less likely at publication.
Windows Schannel: CVE-2026-119952. Microsoft rates this vulnerability Critical, with a base score of 8.1, and assessed exploitation as more likely, although it recorded no exploitation or prior public disclosure at publication. The advisory describes an observable timing discrepancy and says an unauthenticated attacker could send a specially crafted network packet to an affected service to execute code without user interaction.
Schannel exploitation has an additional condition: particular protocol settings or configurations must be present. Microsoft says those requirements reduce the likelihood of widespread or opportunistic attacks.
The Hacker News also highlighted remote code execution fixes for Windows Virtual Filtering Platform, CVE-2026-95962, and Windows Xbox Live Networking Service, CVE-2026-112967, plus a privilege escalation flaw in Azure OpenAI, CVE-2026-119990. Privilege escalation gives an attacker greater permissions.
What administrators should prioritize
Microsoft’s product-family figures include 726 Windows vulnerabilities, 174 in Office, 59 in SQL Server, 53 in Developer Tools, 27 in SharePoint Server, 20 in Azure, nine in Exchange Server, one in Defender and 25 categorized as Other. The Hacker News reports that more than 500 flaws involve privilege escalation, followed by remote code execution and information disclosure. It cites Tenable researcher Satnam Narang as saying Microsoft has addressed more than 5,100 CVEs this year.
For triage, watchTowr threat intelligence head Jake Knott told The Hacker News that teams should start with internet-exposed systems, then vulnerabilities already being exploited, and verify whether they use the vulnerable component and meet its exploitation prerequisites.
Administrators should apply the Outlook fix and the applicable November updates for their deployed products. Microsoft says Windows 10 and Windows 11 updates are cumulative, including earlier security fixes and non-security changes, and stresses installing the latest servicing stack update, which supports Windows update installation. Windows Server 2008 and 2008 R2 customers need Extended Security Updates to continue receiving security updates.
Before deployment, check Microsoft’s listed known issues for SQL Server 2025 CU10 and 2022 CU27; Windows Server 2025, including Hotpatch deployments; Windows Server 2022, 2019 and 2016; Windows 10 versions 1809, 21H2, 22H2 and 1607; and .NET 9.0 and 8.0 updates. Microsoft directs administrators to the Security Update Guide’s Deployments tab and its Known Issues column for details.
