Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft

Microsoft patched 1,094 vulnerabilities in its November 2026 Patch Tuesday release, including an actively exploited zero-day in Outlook tracked as CVE-2026-124194. According to SecurityWeek's report, the spoofing flaw silently leaks a victim's NTLMv2 hash to an attacker who crafts a malicious message file, with no warning shown to the user before credentials are exposed.

This article covers the Outlook zero-day in full — how the attack chain works, which products and editions are affected, who discovered the flaw, and where the November release sits in the broader context of Microsoft's record-breaking 2026 patch year. Security engineers, system administrators, and enterprise IT teams running Microsoft 365, Office LTSC, or Windows should read on before the next maintenance window.

01NTLMv2 hash leak through a crafted message file

CVE-2026-124194 is classified as a spoofing vulnerability rooted in Outlook's failure to alert users before connecting to an external network location. Microsoft rated it "moderate" severity with a CVSS score of 6.5, a relatively low ceiling that belies its in-the-wild exploitation status.

The attack requires no authentication on the attacker's side. An unauthenticated actor sends a specially crafted message file and persuades the recipient to open it. Once opened, Outlook silently connects to an attacker-controlled network location without displaying its standard external-content warning, transmitting the victim's NTLMv2 hash in the process.

That hash can then be used to impersonate the user across other systems. Microsoft confirmed the Preview Pane cannot trigger the vulnerability, narrowing the exposure to recipients who actively open the file — but that remains a realistic social-engineering target in enterprise environments.

02Affected products: Microsoft 365, Office LTSC 2021 and 2024

Three product lines carry the CVE-2026-124194 exposure: Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Microsoft has not disclosed which specific build numbers or update channels were vulnerable before the patch, nor has its advisory described the observed attacks in any detail.

The vulnerability was not publicly known before Microsoft issued the fix, meaning defenders had no opportunity to respond before exploitation began. The company credited two researchers with the discovery: a researcher using the handle "nono" and Benoît Sevens. Microsoft's acknowledgment for Sevens specifically notes the use of Anthropic's Claude AI model in the research.

No exploit code or proof-of-concept has been published alongside the advisory. Organizations running any of the three affected product lines should prioritize deployment of the November updates over the coming patch cycle.

03Windows leads 1,094-flaw November release by volume

Windows accounts for 726 of the vulnerabilities resolved this month, making it by far the largest single surface in the November release. Office follows with 174 flaws patched, then SQL Server at 59, developer tools at 53, SharePoint Server at 27, Azure at 20, and Exchange Server at nine.

Microsoft also republished 165 CVEs originating from third parties as part of the same release, while explicitly noting that Chrome vulnerabilities are not included in that count. Critical-severity updates cover Windows 10, Windows 11, Windows Server 2016 through 2025, Office, Exchange Server Subscription Edition, Edge, the Malware Protection Engine, Azure OpenAI, and Azure Managed Grafana.

November's total of 1,094 is smaller than October's record-setting 1,413. Even so, the cumulative count for the year now exceeds 5,000 vulnerabilities patched by Microsoft in 2026 alone.

04Windows 11 version 23H2 reaches end of security updates

The November release marks the final monthly security update for the Enterprise and Education editions of Windows 11 version 23H2. Devices running either edition will receive no further security patches after this cycle, leaving them exposed to any vulnerabilities discovered from December onward.

Administrators managing fleets still on 23H2 Enterprise or Education must plan an upgrade path before the next significant threat emerges. Microsoft did not announce an extended support option for those specific editions in the November advisory materials.

The same release also coincides with Adobe's November Patch Tuesday, which addressed approximately 110 vulnerabilities across nine separate Adobe products — a parallel patching obligation for organizations running mixed-vendor environments.

05No attack details disclosed, researchers credited AI assistance

Microsoft's advisory for CVE-2026-124194 provides no information about the nature, scale, or geographic scope of the observed attacks. It does not name the threat actor or actors behind the exploitation, and it does not indicate when in-the-wild attacks were first detected.

Researcher Benoît Sevens' acknowledgment is notable for its explicit reference to Anthropic's Claude AI model, reflecting a growing pattern of security researchers incorporating large language models into vulnerability discovery workflows. The other credited researcher, identified only as "nono," has no additional attribution details in the advisory.

The spoofing classification and CVSS 6.5 rating place CVE-2026-124194 below the critical threshold, but active exploitation in the wild overrides the numerical severity label for prioritization purposes. Enterprises should not defer patching on the basis of the moderate rating.