Microsoft has patched an Outlook flaw that attackers were already exploiting, as part of its November 2026 Patch Tuesday release published on Tuesday 10 November 2026.

The flaw, tracked as CVE-2026-124194, is a spoofing vulnerability in Microsoft Office Outlook. Microsoft rates it Moderate, with a CVSS base score of 6.5, and its Security Update Guide lists the exploitability assessment as “Exploitation Detected”. It was not publicly disclosed before the fix was released.

The weakness is classed as CWE-356, a user interface that does not warn users about unsafe actions. According to Microsoft, the flaw could disclose a user’s NTLMv2 hash, which an attacker could then use to authenticate as that user. Microsoft has not said who is behind the attacks or how many users were affected.

Which versions are affected

The flaw affects Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2021, with LTSC 2021 versions before 16.0.14334.21048 listed as affected. Users on those products should install the November security updates as soon as possible.

As of 18:17 UTC on 10 November, the Outlook flaw had not yet appeared in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue, which was last updated on 9 November. That is likely to change, given Microsoft’s own exploited flag.

A very large release, but one urgent fix

The November release document lists 1,342 entries, of which 1,095 are Microsoft-assigned vulnerabilities. Microsoft rates 64 of its own flaws Critical. That is fewer than October’s 1,475 Microsoft-assigned flaws, but still about fifteen times the 71 recorded in November 2025.

Microsoft has said artificial intelligence is helping it discover and analyse vulnerabilities faster and at greater scale. In a Windows Experience blog post on 5 November, Nuno Costa, partner director for Windows servicing and delivery, described an agentic code scanner that uses multiple AI models to find and validate potential flaws before engineers review them.

The size of the release should not distract from the priority. The one flaw Microsoft marks as exploited is a Moderate-rated Outlook bug, the kind of issue a severity-sorted patch queue would push down the list. Patch the exploited flaw first, then work through the rest of the release in the normal monthly cycle.

Windows 11 updates land the same day

Microsoft also released the November Patch Tuesday cumulative updates for Windows 11 on 10 November. KB5132061 covers versions 26H2, 25H2 and 24H2, while KB5131087 covers version 23H2. The updates are mandatory because they contain the November security patches.

Users can install them by going to Start, then Settings, then Windows Update, and selecting Check for Updates. They can also be downloaded manually from the Microsoft Update Catalog. A restart is required after installation.