Microsoft patches 1,093 November 2026 vulnerabilities: prioritize Outlook zero-day

CVE-2026-124194 CVE-2026-125350 Outlook

Microsoft’s November 2026 updates address 1,093 vulnerabilities. Outlook spoofing flaw CVE-2026-124194 is a zero-day under active exploitation. Prioritize updates on systems using Outlook and back up important data before patching Windows.

Microsoft patches 1,093 November 2026 vulnerabilities: prioritize Outlook zero-day

At a glance
Microsoft released November 2026 updates addressing 1,093 vulnerabilities.
CVE-2026-124194 is an Outlook spoofing zero-day under active exploitation.
The update addresses 63 critical flaws and 535 privilege escalation vulnerabilities.
Prioritize updates on systems using Outlook; back up important data before patching Windows.

In this article

Microsoft’s November 2026 security update addresses 1,093 vulnerabilities, including Outlook spoofing flaw CVE-2026-124194, which is under active exploitation. The Krebs on Security report outlines the update and recommends prioritizing systems that use Outlook.

Overview and technical details

CVE-2026-124194 is a spoofing zero-day in Microsoft Outlook. The record confirms that the flaw is under active exploitation, but does not provide a CVSS score for this CVE.

Field	Details
Product	Microsoft Outlook, an email application included with Microsoft 365 Apps for Enterprise and Microsoft Office versions
CVE	CVE-2026-124194
Flaw type	Spoofing
Exploitation status	Zero-day under active exploitation

The November 2026 update addresses 1,093 vulnerabilities overall. Among them, 63 critical flaws could be exploited to take control of Windows systems with little or no user interaction; nearly half of the critical flaws are remote code execution vulnerabilities, and 535 flaws allow privilege escalation.

Affected systems

Systems using Outlook should be prioritized for review. The record does not identify affected Outlook branches or versions, nor does it list fixed versions. The November 2026 updates apply to Windows and supported software.

Exploitation status

CVE-2026-124194 is identified as a zero-day under active exploitation. This is the exploitation status confirmed in the record; the input provides no further information about a public PoC or KEV listing.

System checks

Check the Windows updates installed on a device with the following command:
```
Get-HotFix
```
Compare the results with the organization’s information about Microsoft’s November 2026 updates. The record does not provide a specific KB number for direct confirmation.

Remediation and mitigation

Prioritize addressing CVE-2026-124194 on systems using Outlook.
Install Microsoft’s November 2026 security updates for Windows and supported software through the emergency patching process.
Back up important data before updating the operating system.