- Microsoft's November release covers 1,094 of its own CVEs plus 165 republished non-Microsoft ones. Outlook flaw CVE-2026-124194 is rated Moderate but flagged by Microsoft as exploited.
- A patch count says little about risk. Exploitation status and whether you run the affected product tell a team where to start.
- Confirm Outlook patch status first. Rank patch work by internet exposure and known exploitation before severity score.
A patch count tells you little about your risk
When a single release carries 1,259 CVEs, the number stops being useful. The useful question is which few matter to your organisation this week. This month's Microsoft release shows why. An Outlook flaw that Microsoft says attackers are already using carries a Moderate label.
What Microsoft released
Microsoft's security update guide says the November release consists of 1,094 Microsoft CVEs. Microsoft also republishes 165 non-Microsoft CVEs, with Chrome CVEs not listed. Together that gives the 1,259 total reported by The Hacker News. The outlet calls it the second month in a row above 1,000.
The Hacker News says the release includes 726 flaws in Windows, 174 in Office, 59 in SQL Server and 27 in SharePoint Server. It also lists Developer Tools twice, with 61 and 53. Those two figures do not match, so treat that line with care. By the outlet's count, elevation of privilege is the largest bug class, with well over 500 flaws. Remote code execution and information disclosure bugs follow.
Tenable's Satnam Narang says Microsoft has addressed over 5,100 CVEs this year. The sources do not state how that figure is counted.
The Outlook flaw already in use
CVE-2026-124194 affects Microsoft Outlook. It has a CVSS score of 6.5 and a Moderate rating. Microsoft has flagged it as actively exploited. Its advisory describes spoofing: the product interface does not warn users about an unsafe action.
How the attack works
The Hacker News reports that an unauthenticated attacker sends a specially crafted message file. The target has to be persuaded to open it. Outlook may then connect to a network location the attacker controls, without showing the usual external-content warning.
That connection could disclose authentication information, such as an NTLMv2 hash. NTLMv2 is a Windows sign-in method. When a Windows program connects to a remote server, it can be asked to prove who the user is. The hash is a value derived from the user's credentials, not the password itself. Microsoft says it could be used to impersonate the user. The sources do not say how attackers use the hashes in this case.
Microsoft stresses that exploitation needs network connectivity and user interaction. Action1's Jack Bicer says a captured hash "can let an attacker sign in as the victim, read their data, and move to other systems they can reach." He adds: "The Moderate label undersells this one."
What is still unknown
Microsoft has not attributed the activity to a threat actor. The Hacker News says it has also given no technical details on how the flaw is exploited in the wild. The advisory does not say whether the discovery came before or after attacks began.
Per the outlet, the finding was reported to Microsoft by two parties: a researcher who goes by Nono, and Benoît Sevens of Anthropic, who used Claude. Two credits are not a trend, so this is best left as a single fact.
A score describes the flaw. Exploitation describes your week.
The lesson here is simple. A severity score rates a flaw in the abstract. Exploitation status tells you what is happening now. A Moderate flaw under live attack can matter more than a higher-rated flaw nobody is using. Bicer's point is that the trigger is small: a single click on an email file.
CISA has added the Outlook flaw to its Known Exploited Vulnerabilities catalog. Federal agencies must apply the fix by November 24, 2026. That deadline comes from BOD 22-01 and binds federal agencies only. Other organisations can still treat the listing as a signal.
watchTowr's Jake Knott describes teams straining to work out "what actually matters." His order of work: start with what you have exposed to the internet, then what is already exploited, then everything else. He also advises checking whether you use the vulnerable component at all.
Questions to put to your team
First, has the Outlook update reached every machine that opens email, and can we prove it? Second, does our triage rank by known exploitation before severity score? Third, who can pull a Moderate flaw forward, and how fast?
Fourth, if a stolen hash were used against us, would we see the odd sign-in? Patching closes the door. Detection tells you whether someone already walked through.
A thousand CVEs is a workload. An exploited flaw is the decision. The skill is telling them apart.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Microsoft (MSRC).
