Outlook zero-day fixed in Microsoft's November 2026 update - Tbreak UAE
Microsoft patched an actively exploited Outlook zero-day vulnerability in its November 2026 Patch Tuesday update, which addressed 1,094 security flaws.
The vulnerability, CVE-2026-124194, enables unauthenticated attackers to send specially crafted message files that, when opened in affected Outlook versions, can force the application to connect to attacker-controlled locations without warning. Microsoft rates the flaw as Moderate with a CVSS score of 6.5, but experts warn it's more dangerous than the score suggests.
Critical Update Process
The fix doesn't come through Windows Update but requires updating Microsoft 365 Apps and Office LTSC 2021 and 2024. Users should navigate to File > Account > Update Options > Update Now in Outlook or Word. Organizations may manage updates centrally, and users should avoid opening unexpected attachments until patched.
The fixed builds are 16.0.17932.21140 for Office LTSC 2024 and 16.0.14334.21048 for LTSC 2021. Microsoft's Office release notes list Microsoft 365 Apps builds by channel.
Other Critical Vulnerabilities
Jack Bicer of Action1 identified four other flaws scoring 9.8 on CVSS, including CVE-2026-119958 in Windows LDAP and CVE-2026-118207 in Exchange Server. He advised prioritizing patches for domain controllers and Exchange servers. BleepingComputer counted 1,235 total fixes, with some outlets including Edge fixes in their counts.
The US cybersecurity agency CISA added the Outlook flaw to its Known Exploited Vulnerabilities catalog on November 10, setting a federal deadline of November 24 for patching. The next Patch Tuesday is scheduled for December 8.
Related
