Microsoft Fixes Over 1,000 Flaws, Including Exploited Outlook Bug
Microsoft's November security update fixes more than 1,000 flaws, including an Outlook spoofing bug that attackers have already exploited.
Microsoft on Tuesday released its monthly batch of security fixes, patching more than 1,000 vulnerabilities across Windows, Office, SQL Server and other products. One of them, a spoofing flaw in the Outlook email client, has already been exploited by attackers, the company said. Security researchers urged organizations to prioritize that fix even though Microsoft rates it less severe than dozens of others in the release.
What happened
The November release is part of Patch Tuesday, Microsoft’s regular schedule of security updates published on the second Tuesday of each month. Security firms that track the releases gave slightly different totals. Tenable, a cybersecurity company, counted 1,093 CVEs, the standard public identifiers assigned to known software vulnerabilities. Its tally covered 287 products and components and included 63 flaws rated critical, 1,029 rated important and one rated moderate.
The Windows-focused site Pureinfotech and the release summary published by Qualys, another security firm, put the count of Microsoft vulnerabilities at 1,094. Qualys used a larger headline figure of 1,235 but did not explain the gap. Pureinfotech said Microsoft also republished 165 flaws from outside vendors, which it said should not be counted in the Microsoft total.
Windows accounted for 726 of the vulnerabilities, about two-thirds of the total, according to Pureinfotech and Qualys. Office followed with 174, then SQL Server with 59 and Microsoft’s developer tools with 53.
The Outlook zero-day
The flaw drawing the most attention is CVE-2026-124194, a spoofing vulnerability in Microsoft Outlook. Microsoft lists it as “Exploitation Detected,” meaning the company has seen it used in real attacks, Pureinfotech reported. Microsoft did not say how widely it has been exploited or how many devices were affected.
Qualys said an attacker could send a specially crafted message file. If the victim opened it, Outlook could connect to a network location controlled by the attacker without showing the usual warning about external content, potentially exposing login information. Tenable described a similar scenario in which a malicious Office file could leak a user’s NTLMv2 hash, a scrambled form of Windows login credentials. An attacker could then use that hash to impersonate the user in further attacks.
Tenable scored the flaw 6.5 on the 10-point CVSS severity scale, a moderate rating. Tenable also said Microsoft’s advisory credits a security researcher who found the bug with Claude, the AI model developed by Anthropic. Tenable did not name the researcher.
Other serious flaws
Several bugs carry higher severity scores than the Outlook flaw, although Microsoft has not reported that any of them have been exploited. Among those highlighted by Tenable and Qualys:
- CVE-2026-120002, a SharePoint Server privilege-escalation bug that Tenable scored 9.9 out of 10.
- CVE-2026-118146, a remote code execution flaw in Windows Active Directory Domain Services, the system many companies use to manage user accounts.
- CVE-2026-118207, a remote code execution flaw in Exchange Server, Microsoft’s corporate email software.
- CVE-2026-119952, a Windows Schannel flaw that an attacker could exploit over a network without logging in. Schannel is the Windows component that handles encrypted connections.
Tenable said Microsoft rates many of these as “Exploitation More Likely.” Privilege-escalation bugs made up nearly half of the month’s fixes and remote code execution flaws about 27%, according to Tenable.
Why it matters and what comes next
Microsoft’s monthly releases have grown sharply this fall. Pureinfotech said October’s update covered 1,413 Microsoft vulnerabilities, so November’s total is 319 lower. Even so, a release of more than 1,000 fixes leaves IT teams with a large workload, and security firms said the actively exploited Outlook bug should come first. Pureinfotech advised organizations to review that flaw before the others and check which of their systems are exposed.
For Windows 11, the fixes arrive in update KB5132061, and Windows 10 machines enrolled in Microsoft’s paid Extended Security Updates program receive KB5131096, according to Pureinfotech. Qualys said the next Patch Tuesday is set for Dec. 8.
