Microsoft Outlook zero-day vulnerability actively exploited in the wild

# Microsoft Outlook zero-day vulnerability actively exploited in the wild

https://gcdradar.vercel.app/incidents/microsoft-outlook-zero-day-vulnerability-actively-exploited · AIR-2026-1876 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild during Patch Tuesday.
- Fix status: Patched
- First reported: 2026-11-10
- AI role: No AI role
- Products: Microsoft Outlook
- CVE ids: CVE-2026-124194

## Summary

Microsoft addressed a heavily exploited zero-day vulnerability in Outlook during its November 2026 Patch Tuesday updates. The flaw is part of a broader batch of security fixes released by the vendor.

## What to do

Apply the latest security updates provided by Microsoft for Outlook.

## Affected and fixed versions

- Affected: Microsoft Outlook

## Latest updates

- 2026-11-10: Added to the CISA KEV catalog (exploitation confirmed) (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-124194)
- 2026-11-10: Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft (https://securityweek.com/exploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft)
- 2026-11-10: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day (https://bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day)

## Sources

- 2026-11-10 BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day https://bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day
- 2026-11-10 SecurityWeek: Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft https://securityweek.com/exploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft
- 2026-11-10 The Record: Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row https://therecord.media/patch-tuesday-microsoft-1000-bugs-again
- 2026-11-10 CyberScoop: Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday https://cyberscoop.com/microsoft-patch-tuesday-november-2026
- 2026-11-10 Krebs on Security: Microsoft Fixes Nearly 1,100 Security Vulnerabilities https://krebsonsecurity.com/2026/11/microsoft-fixes-nearly-1100-security-vulnerabilities
- 2026-11-10 CISA: CVE-2026-124194: Microsoft Office — Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-124194
- 2026-11-10 Dark Reading: November Patch Tuesday: An Overflowing Cornucopia of CVEs https://darkreading.com/vulnerabilities-threats/november-patch-tuesday-cornucopia-cves
- 2026-11-11 Cisco Talos: Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities https://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026
- 2026-11-11 The Hacker News: Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes https://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.