Microsoft Patches Exploited Outlook Hash-Disclosure Zero-Day and Over 1,090 Flaws

Microsoft’s November Patch Tuesday release fixes more than 1,090 vulnerabilities, including CVE-2026-124194, an actively exploited Outlook spoofing zero-day. Opening a specially crafted message file can cause Outlook to connect to an attacker-controlled network location without the normal external-content warning, potentially exposing the user’s NTLMv2 authentication hash for impersonation. The Preview Pane is not an attack vector. Microsoft rates the flaw Moderate with a CVSS score of 6.5 but has not disclosed details of the observed attacks. Affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Tenable and Cryptika report 1,093 patched vulnerabilities, including 63 Critical issues, while SecurityWeek reports 1,094.

Prioritize the exploited Outlook fix despite its Moderate rating, then promptly test and deploy applicable updates for exposed infrastructure and Office applications. Other highlighted fixes address Active Directory Domain Services, Exchange Server, SharePoint Server, Windows Schannel, and Windows Search, including a reported zero-click code-execution path through Exchange attachment indexing. Zero Day Initiative identified 30 Microsoft flaws as potentially wormable, while cautioning that limited advisory details make some classifications uncertain. Administrators should use Microsoft’s Security Update Guide to determine applicable patches and account for the final monthly security updates for Windows 11 version 23H2 Enterprise and Education editions. Separately, Adobe patched 110 unique vulnerabilities across nine bulletins; Zero Day Initiative prioritized Connect and Experience Manager because of critical network-accessible flaws.