Microsoft has fixed 1,093 security flaws in its November Patch Tuesday release, including an Outlook vulnerability that attackers are already exploiting to steal users’ login credentials.
The exploited flaw
The one actively exploited bug, tracked as CVE-2026-124194, is an Outlook spoofing flaw rated Moderate by Microsoft, with a CVSS score of 6.5. An attacker sends a specially crafted message file, and when the user opens it, Outlook connects to an attacker-controlled network location without showing the usual warning about external content, disclosing the user’s NTLMv2 hash, which can be used to impersonate that user.
The flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. CISA added the bug to its Known Exploited Vulnerabilities catalogue on the same day and gave federal civilian agencies until November 24 to fix it. Microsoft has not shared details about the attacks or identified the attackers.
A researcher using Claude
Microsoft credited the discovery to a researcher who goes by “nono” along with Benoit Sevens, whose acknowledgement reads “using Claude with Anthropic” — a reference to Anthropic’s AI assistant. The detail drew attention because Anthropic itself set the price range for its $1.4 trillion stock market listing on the same day.
The scale of the release
Of the 1,093 Microsoft-assigned vulnerabilities, 63 are rated Critical, 1,029 Important and one Moderate. The full release lists 1,342 entries once Chromium and open-source component fixes are included. Five critical vulnerabilities carry CVSS scores of 9.8, and nearly half of the critical bugs are remote code execution flaws.
The release also includes a critical remote code execution fix for Exchange Server and a third Outlook Preview Pane remote code execution fix in three months. It is the second four-figure Patch Tuesday in a row, and industry CVE assignments this year are running near 95,000, according to Ivanti’s Chris Goettl. The updates cover Windows, Microsoft Office, Exchange Server, Active Directory, Azure and several other products. Five critical vulnerabilities carry CVSS scores of 9.8, and Microsoft has not reported active exploitation of those five — the Outlook flaw is the one bug Microsoft says is already being exploited, and CISA’s order gives federal agencies until November 24 to patch it.
