Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes

In the current patch cycle Microsoft fixed 1,259 vulnerabilities, including 726 in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server and 27 in SharePoint Server; more than 500 relate to privilege escalation, followed by remote code execution and information disclosure. Highlighted is CVE-2026-124194 in the Outlook client (CVSS 6.5), a spoofing flaw that Microsoft says is already being exploited in the wild: an unauthenticated actor can send a specially crafted message file and persuade a victim to open it, while the product UI gives no warning, potentially exposing NTLMv2 hashes. The U.S. agency CISA added the flaw to its Known Exploited Vulnerabilities catalog and set remediation deadlines for federal agencies. Microsoft has not attributed the activity to a threat actor or published technical details of the exploitation, and it remains unclear whether discovery came before or after attacks began. The remaining entries include 165 CVE identifiers not issued by Microsoft itself.