Microsoft patches Outlook zero-day in record November Patch Tuesday

Microsoft's November 11 Patch Tuesday fixes one actively exploited zero-day: CVE-2026-124194, a spoofing flaw in Microsoft Outlook that attackers are using to steal NTLM authentication hashes. It ships inside the largest Patch Tuesday on record. Deploy this week.

The primary reference is Microsoft's Security Update Guide for the November release.

The exploited zero-day

CVE-2026-124194 affects Microsoft 365 Apps for Enterprise and Microsoft Office. Per Microsoft, it is the only flaw in this batch already under active exploitation. Exploitation requires the target to open a specially crafted message file, plus network connectivity and user interaction; a successful attack leaks NTLM hashes an attacker can then relay or crack offline. Microsoft has not named the actor and no public PoC was available at release.

How big this release is

The totals don't fully reconcile across trackers:

• SecurityWeek counts 1,094 Microsoft CVEs.
• BleepingComputer reports 1,235, folding in 108 flaws fixed earlier in the month and 142 Microsoft Edge issues.
• Krebs on Security puts the core figure at 1,093.

Either way it clears 1,000 for the second month in a row — The Record notes the streak — after October's 1,411 flaws. Microsoft rated more than 60 critical, with close to half being remote code execution.

Also worth prioritizing

None of these are reported exploited, but they carry critical RCE ratings and sit on high-value surfaces:

• CVE-2026-118207 — Microsoft Exchange Server RCE.
• CVE-2026-118146 — Active Directory Domain Services RCE.
• A cluster of Microsoft Office / Excel RCEs (CVE-2026-120003, CVE-2026-111289, and several Excel entries) that trigger through crafted documents.

Action checklist

1. Deploy the November updates across your Windows, Office/Microsoft 365, and Exchange estate this week. Lead with internet-facing and high-blast-radius hosts.
2. Prioritize the Outlook/Office clients. CVE-2026-124194 is the live one; patched Office builds close it.
3. Harden against NTLM relay as defense-in-depth: enforce SMB signing, enable Extended Protection for Authentication on Exchange and IIS, and restrict outbound NTLM where you can. These blunt the hash-theft payoff even before every client is patched.
4. Patch Exchange and domain controllers on their own change window. CVE-2026-118207 and CVE-2026-118146 belong to the same blast radius as the identity tier.
5. Update Chromium browsers. Edge and Chrome shipped their own fixes this cycle, including another Chrome zero-day (CVE-2026-125350).

Context

Two consecutive four-figure Patch Tuesdays is the new baseline, not an anomaly — the volume reflects both Microsoft's widening CVE disclosure and the Office/Excel parser surface that keeps generating RCEs. The one number that matters operationally is still "1 exploited." Chris Goettl of Ivanti, quoted by Krebs, notes roughly 217 CVEs have landed on CISA's KEV list this year, and about 44% of exploited bugs sit in edge and remote-access gear — a reminder to rank by exploitation and exposure, not by raw count.