Counts differ between outlets: BleepingComputer counts 1,235 flaws, including 66 critical ones and 48 that allow remote code execution, while SecurityWeek counts 1,094. Last month the company fixed 1,411. According to BleepingComputer, the high numbers are linked to Microsoft's use of AI to find and fix vulnerabilities.
The zero-day, CVE-2026-124194, is a spoofing flaw in Outlook. An attacker can send a specially crafted message file, and if the user opens it, Outlook connects to the attacker's server without showing the usual external-content warning. That can leak the user's NTLMv2 hash, which can be used to impersonate them and sign in to corporate accounts. Microsoft rates the flaw as moderate (CVSS 6.5) and says it cannot be triggered through the Preview Pane. The company has not shared details about the attacks.
What to do: install the November updates, especially the Outlook fix. According to SecurityWeek, affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Users should be especially careful with unexpected attachments, because the attack requires the user to open the file.
