An Outlook fix belongs at the front of Microsoft's November rollout. Microsoft says attackers exploited a spoofing flaw before the 10 November updates shipped. For administrators, the first question is which Office builds are running on affected devices. Exchange servers and Windows systems need their own update and verification steps.

BlackTree counted 1,093 distinct vulnerabilities in Microsoft's 10 November release cohort. Microsoft rates 63 Critical on at least one affected product. The Outlook flaw is the sole entry in that cohort marked as exploited, and none is marked as publicly disclosed in the release data checked on 11 November. Microsoft's November release data.

Microsoft rates CVE-2026-124194 Moderate, with a CVSS score of 6.5. Its advisory describes an attacker persuading someone to open a crafted message file in an affected Outlook client. Outlook can then contact an attacker-controlled location without its usual warning about external content, exposing NTLMv2 authentication material that could be used to impersonate the user. Microsoft says opening the file is required and excludes the Preview Pane as an attack path for this flaw. Microsoft's release summary and Microsoft's CVE record.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 10 November and lists 24 November as the due date. Start with the affected Office editions and confirm the running build after the update. Where a suspicious file was already opened, preserve the message and review relevant endpoint, outbound connection and authentication evidence with the incident response team. A patch closes the vulnerability on the updated device. The investigation covers what…