1,094 patches, one live attack: why Microsoft's Moderate Outlook bug can't wait

Microsoft released its November 2026 Patch Tuesday updates on November 10, fixing 1,094 CVEs. Exactly one of them is being exploited in the wild: CVE-2026-124194, a spoofing flaw in Outlook that can leak a victim's NTLMv2 authentication information. Microsoft rates it Moderate, with a CVSS score of 6.5.

An attacker needs no account and no existing privileges. The victim opens a specially crafted message file in an affected Outlook installation, and Outlook connects to an attacker-controlled network location without showing its normal external-content warning. That connection discloses the victim's NTLMv2 authentication information, which attackers can capture and potentially use to impersonate the victim. Affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.

Qualys counts 1,235 vulnerabilities addressed this month, including 63 critical and 1,029 important-severity, with only one exploited in the wild. That single exploited flaw is not among the criticals. It is the third month running that the bug attackers actually use carries a rating below Critical.

That pattern is the operational problem. Severity-driven triage sorts by CVSS and rating; exploit-driven triage sorts by what is being used. A 6.5 Moderate can sit behind a queue of 63 criticals that nobody is attacking, while the one flaw with confirmed exploitation waits. Administrators are being urged to address CVE-2026-124194 immediately for that reason.

Microsoft has not disclosed who is exploiting the flaw, when the attacks began, or how widespread they are.

Because exploitation requires a user to open a malicious file, email gateway filtering and security awareness training can reduce exposure until the patch is deployed. The patch itself shipped November 10 as part of the monthly release.