Microsoft fixes exploited Outlook flaw in November security updates

Microsoft fixes exploited Outlook flaw in November security updates

10 November 2026: Microsoft's November security updates fix CVE-2026-124194, a spoofing flaw in Outlook that attackers are already exploiting. A crafted message file, once opened, makes Outlook connect to a network location the attacker controls without showing the usual external-content warning, which can leak authentication information that lets the attacker impersonate the user. CISA added it to its catalogue of exploited vulnerabilities the same day.

The one flaw marked as exploited

Microsoft scores CVE-2026-124194 at 6.5, a moderate number for a flaw in active use, because the victim has to open the file. The Preview Pane is not an attack vector, Microsoft says, so the risk is in a user double-clicking an attachment rather than in mail arriving. It is the only entry in the release that Microsoft marks as exploited, and none is marked as publicly disclosed.

CISA's catalogue lists the Outlook flaw with a due date of 24 November 2026 for US federal agencies. The fix ships through the normal Microsoft 365 Apps and Office update channels.

For organisations that still allow outbound SMB or WebDAV traffic from user devices, blocking it at the perimeter is the long-standing control for this class of credential leak, alongside the patch.

A zero-click path through Exchange

The flaw with the most reach for a mail team is not the exploited one. CVE-2026-116928, scored 9.8, is in the Windows Search component that Exchange Server uses to index attachments. Microsoft says an unauthenticated attacker can send an email with a crafted attachment, Exchange processes it for indexing automatically, and the recipient never has to open anything. Microsoft rates exploitation "less likely", but on-premises Exchange servers should be near the front of the queue.

Exchange Server has its own fixes too, including CVE-2026-118149, a remote code execution flaw for an authenticated attacker scored 8.8.

Other high scores worth scheduling

• CVE-2026-116945, SQL Server, 9.8: remote code execution, with GDR and cumulative-update packages per version.
• CVE-2026-119958, Windows LDAP, 9.8: an unauthenticated attacker can run code in the LDAP service with crafted calls.
• CVE-2026-120002, SharePoint Server, 9.9: a user with site read access and Secure Store membership can make SharePoint act on a connected business service with shared credentials.
• CVE-2026-109467, Azure DevOps, 9.9: a user with Project Reader access can trigger unauthorised pipeline runs and execute code on pipeline agents.

The highest score in the release, 10.0, belongs to CVE-2026-109469 in Entra Device Registration, which Microsoft has already fixed in the service; customers have nothing to do.

Ordering the work

The Outlook fix goes to every desktop because it is in use; the Windows Search and Exchange fixes go to mail servers first because they need no user at all. SQL Server and LDAP follow wherever those services are reachable from untrusted networks. We list seven products in patch management software.

Sources

• Microsoft Security Response Center: November 2026 Security Updates (CVRF), 10 November 2026, 10 November 2026
• Microsoft: CVE-2026-124194, Microsoft Outlook Spoofing Vulnerability, 10 November 2026
• CISA: Known Exploited Vulnerabilities catalogue, CVE-2026-124194 added 10 November 2026, 10 November 2026