Microsoft fixes 1,259 flaws, including exploited Outlook bug

Microsoft released fixes for 1,259 vulnerabilities across its software on 10 November, including an Outlook flaw the company says attackers are actively exploiting. It was the second consecutive month in which the company’s patch volume exceeded 1,000 flaws.

The Outlook flaw, identified as CVE-2026-124194, could expose information used to authenticate a user. Microsoft rates it Moderate, with a severity score of 6.5.

How the Outlook flaw works

An attacker without prior authentication could send a specially crafted message file and persuade someone to open it in an affected version of Outlook. The file could cause Outlook to connect to a network location controlled by the attacker without its usual warning about external content, potentially exposing authentication information that could be used to impersonate the user. Microsoft says exploitation requires a network connection and user interaction.

The information could include an NTLMv2 hash, a piece of authentication material. Jack Bicer, director of vulnerability research at Action1, said a captured hash could allow an attacker to sign in as the victim, read their data and move to other systems the victim can access.

Microsoft has not attributed the exploitation to a particular attacker or given technical details of the attacks. Its advisory also does not say whether the flaw was discovered before or after exploitation began. Microsoft credited researcher Nono and Anthropic’s Benoît Sevens, who used Claude, with discovering and reporting it.

Affected Office versions

Microsoft’s vulnerability record lists the following affected versions on both 32-bit and x64 systems. The fixed builds are excluded from the affected ranges.

Some Windows users report installation failures

Some users said Windows update KB5132061 failed to download or install, The Register said. Users reported error codes 0x800F0993 and 0x800F0989. As of its November 11 report, Microsoft listed no known issues with the update and had not explained the reported failures.

One user said the update installed after they disabled Windows Sandbox and restarted the computer. Others reported failures regardless of whether the feature was enabled; Microsoft had not confirmed that approach as a fix.

Patch scope and federal deadline

The release includes 165 vulnerability identifiers issued by organizations other than Microsoft, The Hacker News said. Its reported product counts include:

Satnam Narang, a senior staff research engineer at Tenable, said the release brings Microsoft’s total for 2026 to more than 5,100 vulnerabilities addressed. Jake Knott, head of threat intelligence at watchTowr, advised administrators to prioritize components exposed to the internet, then flaws already being exploited, and to check whether they use the affected component and meet the conditions for exploitation.

The US Cybersecurity and Infrastructure Security Agency added the Outlook flaw to its catalog of known exploited vulnerabilities on 10 November. Federal agencies must apply the fix by 24 November 2026; the agency’s recorded action also calls for vendor-directed mitigations and compliance with its risk-based patching and forensic-triage guidance.