Microsoft Patches Over 1,093 Security Flaws, Including Outlook Zero-Day Exploited in Attacks - Cyber Press
Microsoft has released security updates addressing more than 1,093 vulnerabilities, including a zero-day flaw in Outlook that has been actively exploited in attacks.
Among the patched flaws is CVE-2026-124194, a moderate severity spoofing vulnerability in Microsoft Outlook that attackers have already been exploiting. The security update comes as part of Microsoft's November 2026 Patch Tuesday, addressing vulnerabilities across its extensive product ecosystem.
Critical vulnerabilities patched
The majority of the patched vulnerabilities are classified as critical, with multiple remote code execution flaws affecting Windows Active Directory Domain Services, Microsoft Office components including Excel, Word, and PowerPoint, and various Windows subsystems. Several Azure services also received patches for elevation of privilege vulnerabilities.
Notable critical vulnerabilities include CVE-2026-118146, a remote code execution flaw in Windows Active Directory Domain Services, and multiple remote code execution issues in Microsoft Office applications that could allow attackers to execute arbitrary code on affected systems.
Security recommendations
Microsoft recommends that users and organizations apply these security updates as soon as possible to protect their systems from potential exploits. The company has not provided details about any active attacks targeting the newly patched vulnerabilities beyond the confirmed Outlook zero-day exploitation.
Related
