Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft

In November 2026, Microsoft closed a total of 1,094 vulnerabilities through its Patch Tuesday updates, including the Outlook flaw CVE-2026-124194. It is classified as a spoofing issue arising because Outlook does not warn the user before a potentially dangerous action; Microsoft assigns it a severity rating of 'moderate' and a CVSS score of 6.5. The company confirms active exploitation but provides no information about the observed attacks in its advisory. Successful exploitation requires tricking a victim into opening a specially crafted message file; affected products include Microsoft 365 Apps. The vulnerability was not publicly disclosed before the fix became available. In parallel, the Enterprise and Education editions of Windows 11 version 23H2 reach end of servicing and will no longer receive monthly security updates.