Microsoft Patch Tuesday: Outlook Zero-Day and 1,000+ Vulnerabilities Disclosed

Microsoft November 2026 Patches

Microsoft disclosed 1,093 vulnerabilities in its latest Patch Tuesday release, setting a pace that puts the company on track to surpass 5,160 reported bugs for the year, according to therecord.media.

That figure follows a massive release last month featuring more than 1,400 disclosures, building on approximately 900 vulnerabilities reported in September. The Cybersecurity and Infrastructure Security Agency added a zero-day vulnerability impacting Microsoft Outlook to its Known Exploited Vulnerabilities catalog.

Outlook Zero-Day Exploitation

The active exploit centers on CVE-2026-124194, a bug carrying a severity score of 6.5. CISA ordered federal civilian agencies to apply patches by the end of the month.

Microsoft stated that an attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file triggers a connection to an attacker-controlled network location without displaying standard external-content warnings.

According to Microsoft, this behavior potentially discloses authentication information that bad actors can use to impersonate the user. Tenable senior staff research engineer Satnam Narang said an attack using the vulnerability may allow someone to sign in as the exploited user.

Microsoft revealed that Benoît Sevens discovered the bug using Anthropic’s Claude. Out of the total November disclosures, 63 vulnerabilities received critical ratings.

Federal Emergency Directives

CISA ordered federal agencies to investigate potential compromises and apply patches by Friday for two critical bugs affecting Barracuda’s email security product, tracked as CVE-2026-116606 and CVE-2026-111560. The latest Patch Tuesday release actually addresses more than 1,000 vulnerabilities across various software ecosystems.

The update fixes numerous components including .NET, Azure DevOps Server, Azure File Sync, Azure Firmware, and Microsoft Edge based on Chromium. Google, Cisco, Adobe, Barracuda, and Ivanti also released patches for dozens of bugs. Several of those third-party flaws earned spot-checks from CISA as actively exploited in enterprise environments.

Questions About the Outlook Zero-Day and Microsoft Vulnerabilities

When must federal agencies patch the Outlook zero-day?

CISA mandated that all federal civilian agencies patch CVE-2026-124194 by the end of the month.

How many total vulnerabilities has Microsoft disclosed this year?

Satnam Narang noted that the November release brings Microsoft’s total disclosed vulnerabilities past 5,160 for the year.