Microsoft Patches Exploited Outlook Credential Leak and Critical Windows RCE Flaws

Microsoft’s November security updates fix an actively exploited Outlook spoofing vulnerability, CVE-2026-124194, alongside numerous critical remote code execution flaws. The Outlook issue can disclose NTLMv2 credentials when a user opens a crafted message file; despite its Moderate severity rating and CVSS score of 6.5, exploitation makes it a patching priority. Zero Day Initiative (ZDI) reports approximately 1,090 new Microsoft CVEs, while SANS ISC reports 1,260 vulnerabilities, including 167 Chromium issues affecting Edge and 68 rated Critical. Highlighted attack surfaces include Windows LDAP, Schannel, Message Queuing, TCP/IP, and Windows Search, where Exchange attachment indexing can enable zero-click code execution.

ZDI classifies 30 Microsoft vulnerabilities as potentially wormable, while cautioning that limited advisory detail makes some classifications uncertain. Security teams should prioritize the exploited Outlook flaw and rapidly test and deploy applicable fixes for exposed infrastructure, including Exchange, LDAP, DNS, and DHCP. ZDI also flags an Azure OpenAI privilege-escalation advisory that lacks customer remediation instructions. Separately, Adobe addressed 110 unique CVEs across nine bulletins; Adobe Connect and Experience Manager warrant the highest Adobe patching priority because of critical network-accessible vulnerabilities, including Connect flaws rated CVSS 10.0.