Microsoft’s November 10, 2026, security update fixed more than 1,000 flaws, including an Outlook flaw that attackers had already used to expose users’ Windows sign-in data.
Tenable counted 1,093 Microsoft vulnerabilities in the update, with 63 rated critical. A broader count by BleepingComputer reached 1,235 by including flaws in Microsoft Edge, which is based on Chromium. The totals vary depending on how the flaws are counted.
The Outlook bug, listed as CVE-2026-124194, is a flaw that can let attackers make a false identity seem trusted. Attackers can trigger it by persuading someone to open a specially made file. Outlook may then connect to a location controlled by an attacker without showing its usual warning.
This could reveal the user’s NTLMv2 authentication hash, a coded form of sign-in data. Attackers could use it in later attempts to impersonate the user. Microsoft rated the flaw moderate and gave it a score of 6.5 on the CVSS scale.
But because Microsoft confirmed that attackers had exploited it, installing the patch is an urgent priority. The update also fixes critical flaws across Microsoft products and components that could let attackers run code remotely. It also fixes critical flaws that could let attackers gain higher levels of access across Microsoft products and components.
Because the Outlook fix comes through affected Office products, users should check for Office updates as well as Windows patches. People using work-managed devices should follow their IT team’s guidance.